CVE-2017-14190

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Fortinet, Inc.	FortiOS	5.6.0 to 5.6.2; 5.4.0 to 5.4.7; 5.2 and all earlier versions.

References

http://www.securityfocus.com/bid/102779Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040284Third Party Advisory, VDB Entry
https://fortiguard.com/advisory/FG-IR-17-262Mitigation, Vendor Advisory
http://www.securityfocus.com/bid/102779Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040284Third Party Advisory, VDB Entry
https://fortiguard.com/advisory/FG-IR-17-262Mitigation, Vendor Advisory

Timeline

Published: Jan 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-141915.9An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attac CVE-2017-141926.1The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field.CVE-2017-141936.1The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.CVE-2017-141946.1The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.CVE-2017-141956.1The call_msg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explo CVE-2017-141967.5An issue was discovered in Squiz Matrix from 5.3 through to 5.3.6.1 and 5.4.1.3. An information disclosure caused by a Path Traversal issue CVE-2017-141976.1An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. There are multiple reflected Cross-Site Scripting (XSS) iss CVE-2017-141988.8An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. Authenticated users with permissions to edit design assets CVE-2017-141999.8A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0.CVE-2017-142017.8Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote co CVE-2017-142027.8Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or te CVE-2017-14216.1IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte