FortiManager and FortiAnalyzer Web ui xss Vulnerability (CVE-2014-2336)

FortiManager and FortiAnalyzer Web ui xss Vulnerability (CVE-2014-2336)

Release date:
Updated on:

Affected Systems:
Fortinet FortiAnalyzer <5.0.7
Description:
CVE (CAN) ID: CVE-2014-2336

FortiAnalyzer is a centralized Log Data Analysis Solution for Fortinet security devices.

In versions earlier than Fortinet FortiAnalyzer 5.0.7, Web user interfaces have multiple cross-site scripting vulnerabilities. Remote attackers can exploit this vulnerability to inject arbitrary Web scripts or HTML.

<* Source: Oded Vanunu
Adi Volkovitz
*>

Suggestion:
Vendor patch:

Fortinet
--------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.fortiguard.com/advisory/FG-IR-14-033/

This article permanently updates the link address: