{"id":"CVE-2019-5586","state":"PUBLISHED","title":"A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized mali","description":"A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the \"param\" parameter of the error process HTTP requests.","publishedAt":"2019-06-04T21:39:52.000Z","updatedAt":"2024-10-25T14:06:19.112Z","severity":null,"assigner":"fortinet","products":["Fortinet Fortinet FortiOS"],"affected":[{"vendor":"Fortinet","product":"Fortinet FortiOS","versions":[{"version":"FortiOS 5.2.0 to 6.0.4","status":"affected"}]}],"references":["https://fortiguard.com/advisory/FG-IR-19-034","http://www.securityfocus.com/bid/108610"],"weaknesses":[],"ingestedAt":"2026-10-29T19:46:04.126Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/5xxx/CVE-2019-5586.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-5586","state":"PUBLISHED","datePublished":"2019-06-04T21:39:52.000Z","dateUpdated":"2024-10-25T14:06:19.112Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2019-01-07T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the \"param\" parameter of the error process HTTP requests."}],"affected":[{"vendor":"Fortinet","product":"Fortinet FortiOS","versions":[{"version":"FortiOS 5.2.0 to 6.0.4","status":"affected"}]}],"references":[{"url":"https://fortiguard.com/advisory/FG-IR-19-034","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/108610","name":"108610","tags":["vdb-entry","x_refsource_BID"]}],"problemTypes":[{"descriptions":[{"description":"Execute unauthorized code or commands","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"fortinet","dateUpdated":"2019-10-23T19:12:06.000Z","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8"},"datePublic":"2019-05-24T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@fortinet.com","ID":"CVE-2019-5586","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Fortinet FortiOS","version":{"version_data":[{"version_value":"FortiOS 5.2.0 to 6.0.4"}]}}]},"vendor_name":"Fortinet"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the \"param\" parameter of the error process HTTP requests."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Execute unauthorized code or commands"}]}]},"references":{"reference_data":[{"name":"https://fortiguard.com/advisory/FG-IR-19-034","refsource":"CONFIRM","url":"https://fortiguard.com/advisory/FG-IR-19-034"},{"name":"108610","refsource":"BID","url":"http://www.securityfocus.com/bid/108610"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/advisory/FG-IR-19-034","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/108610","name":"108610","tags":["vdb-entry","x_refsource_BID","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T20:01:50.819Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-23T13:59:51.816805Z","id":"CVE-2019-5586","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-25T14:06:19.112Z"}}]}}}