CVE-2015-3620

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/May/13Exploit, Third Party Advisory, VDB Entry
http://www.fortiguard.com/advisory/FG-IR-15-005/Vendor Advisory
http://www.securityfocus.com/archive/1/535452/100/0/threaded
http://www.securityfocus.com/bid/74646Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032262Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/May/13Exploit, Third Party Advisory, VDB Entry
http://www.fortiguard.com/advisory/FG-IR-15-005/Vendor Advisory
http://www.securityfocus.com/archive/1/535452/100/0/threaded
http://www.securityfocus.com/bid/74646Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032262Third Party Advisory, VDB Entry

Timeline

Published: May 12, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-36219.3Untrusted search path vulnerability in SAP Enterprise Central Component (ECC) allows local users to gain privileges via a Trojan horse progr CVE-2015-36224.3The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-CVE-2015-36236.4XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forger CVE-2015-36245.8Cross-site request forgery (CSRF) vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System (C CVE-2015-36257.2The NVIDIA GPU driver for FreeBSD R352 before 352.09, 346 before 346.72, R349 before 349.16, R343 before 343.36, R340 before 340.76, R337 be CVE-2015-36264.3Cross-site scripting (XSS) vulnerability in the DHCP Monitor page in the Web User Interface (WebUI) in Fortinet FortiOS before 5.2.4 on Fort CVE-2015-36277.2Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows CVE-2015-36289.0The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6,CVE-2015-36297.8Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitr CVE-2015-36307.2Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, whi CVE-2015-36313.6Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows v CVE-2015-36324.3Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and cras