Skip to content
CVE PROGRAM SOURCE RECORD4.7 Medium

CVE-2019-16151

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to eit

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's browser context. This happens when the FortiGate has web filtering and category override enabled/configured.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiOS

Default version status: unaffected

  • 6.4.0 to ≤ 6.4.1affected
  • 6.2.0 to ≤ 6.2.9affected

References