PT-2020-5530
CVE-2019-17651
·
تاريخ النشر
2020-01-27
·
تاريخ التحديث
2020-01-29
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
FortiSIEM versions 5.2.5 and below
Description
The issue is related to improper neutralization of input in the description and title parameters of a Device Maintenance Schedule. This could allow a remote attacker to conduct a Stored Cross Site Scripting attack by injecting malicious JavaScript code into the description field of a Device Maintenance schedule.
Recommendations
For FortiSIEM versions 5.2.5 and below, consider restricting access to the Device Maintenance Schedule feature until a patch is available, and avoid using the description field for any input that may contain malicious code.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾