{"containers": {"cna": {"affected": [{"product": "Fortinet FortiOS", "vendor": "Fortinet, Inc.", "versions": [{"status": "affected", "version": "FortiOS versions 5.2.0 through 5.2.11, and 5.4.0 through 5.4.4"}]}], "datePublic": "2017-09-11T00:00:00", "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.2.0 through 5.2.11 and 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via the \"Groups\" input while creating or editing User Groups."}], "problemTypes": [{"descriptions": [{"description": "Execute unauthorized code or commands", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-09-12T09:57:01", "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet"}, "references": [{"name": "1038705", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1038705"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://fortiguard.com/advisory/FG-IR-17-127"}, {"name": "99098", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/99098"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@fortinet.com", "DATE_PUBLIC": "2017-09-11T00:00:00", "ID": "CVE-2017-7735", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Fortinet FortiOS", "version": {"version_data": [{"version_value": "FortiOS versions 5.2.0 through 5.2.11, and 5.4.0 through 5.4.4"}]}}]}, "vendor_name": "Fortinet, Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.2.0 through 5.2.11 and 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via the \"Groups\" input while creating or editing User Groups."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Execute unauthorized code or commands"}]}]}, "references": {"reference_data": [{"name": "1038705", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1038705"}, {"name": "https://fortiguard.com/advisory/FG-IR-17-127", "refsource": "CONFIRM", "url": "https://fortiguard.com/advisory/FG-IR-17-127"}, {"name": "99098", "refsource": "BID", "url": "http://www.securityfocus.com/bid/99098"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T16:12:28.403Z"}, "title": "CVE Program Container", "references": [{"name": "1038705", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1038705"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://fortiguard.com/advisory/FG-IR-17-127"}, {"name": "99098", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/99098"}]}]}, "cveMetadata": {"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "assignerShortName": "fortinet", "cveId": "CVE-2017-7735", "datePublished": "2017-09-12T02:00:00Z", "dateReserved": "2017-04-12T00:00:00", "dateUpdated": "2024-09-16T20:43:17.682Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fortinet:fortios:5.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "7E627C59-7C16-44F0-800D-A2E8A766B26D", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "233236FA-BB13-4261-BE2E-3E617406DC53", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "27844CC9-498B-4A65-91AC-AC130222EE5F", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "27B4C672-7ED5-4113-87AE-5774D1263C0B", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "2CBEA3AA-AE46-4A55-91EE-9ADC187BF614", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "05CB7A90-91BC-49AF-9B5C-EBD212484C64", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "864D3221-177B-43CE-BD7D-CB14A110268E", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.7:*:*:*:*:*:*:*", "matchCriteriaId": "31C186D6-6AC5-49EB-A701-C91358B4A25F", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.8:*:*:*:*:*:*:*", "matchCriteriaId": "DAC9F6C4-F887-4F25-87BD-383F6CF39806", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.9:*:*:*:*:*:*:*", "matchCriteriaId": "F8558962-7A19-4F4A-BED0-9CB5D4CFC422", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.10:*:*:*:*:*:*:*", "matchCriteriaId": "EC63D521-EC88-4B13-BC73-3284F3FCF3A4", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.11:*:*:*:*:*:*:*", "matchCriteriaId": "DB756AF8-F9D2-472E-867B-C04D11F62FA5", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "1668AE14-D9A4-4B7D-BC3F-75885792875A", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "9E0F3B9B-A06F-4A96-B2E7-9DC56E629182", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "50F8AE97-A647-4A37-8EF2-BC0BBCC8EADD", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "377A2F0B-2A58-4C2C-B546-3178B353484B", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.4.4:*:*:*:*:*:*:*", "matchCriteriaId": "20EBDFD4-45A0-47CC-817E-48E84F945402", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.2.0 through 5.2.11 and 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via the \"Groups\" input while creating or editing User Groups."}, {"lang": "es", "value": "Una vulnerabilidad de tipo Cross-Site Scripting en Fortinet FortiOS desde la versi\u00f3n 5.2.0 hasta la 5.2.11 y 5.4.0 hasta la 5.4.4 permite que atacantes remotos ejecuten c\u00f3digo o comandos sin autorizaci\u00f3n mediante la entrada \"Groups\" al crear o editar grupos de usuarios."}], "id": "CVE-2017-7735", "lastModified": "2017-09-15T12:50:15.230", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-09-12T02:29:00.420", "references": [{"source": "psirt@fortinet.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99098"}, {"source": "psirt@fortinet.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1038705"}, {"source": "psirt@fortinet.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://fortiguard.com/advisory/FG-IR-17-127"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}