What is CVE-2017-7736?

CVE-2017-7736 is a medium-severity vulnerability in Fortinet Fortiweb, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2017-11-22.

How severe is CVE-2017-7736?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Fortinet Fortiweb

CVE-2017-7736

A stored Cross-site Scripting (XSS) vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (25.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Fortinet Fortiweb — versions 5.8.0
Fortinet, Inc. Fortinet Fortiweb — versions FortiWeb 5.8.0, 5.7.1 and earlier

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

psirt@fortinet.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
psirt@fortinet.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2017-7736?: CVE-2017-7736 is a medium-severity vulnerability in Fortinet Fortiweb, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2017-11-22.
How severe is CVE-2017-7736?: Medium severity. CVSS v3 base score is 5.4 out of 10.