CVE-2018-1355

EPSS 1.6%

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 1.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

27 Jun 2018Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows attacker to inject script code during converting a HTML table to a PDF document under the FortiView feature. An attacker may be able to social engineer an authenticated user into generating a PDF file containing injected malicious URLs.

Affected products

Fortinet, Inc. · Fortinet FortiManager, FortiAnalyzer

References

https://fortiguard.com/advisory/FG-IR-18-022 http://www.securityfocus.com/bid/104546 http://www.securitytracker.com/id/1041184 http://www.securitytracker.com/id/1041185