Test ID:	1.3.6.1.4.1.25623.1.0.105594
Category:	FortiOS Local Security Checks
Title:	Fortinet FortiOS Multiple Vulnerabilities (FG-IR-16-003)
Summary:	Fortinet FortiOS is prone to multiple vulnerabilities.
Description:	Summary: Fortinet FortiOS is prone to multiple vulnerabilities. Vulnerability Insight: The following flaws exist: - It is possible to inject malicious script through the DHCP HOSTNAME option. The malicious script code is injected into the device's `DHCP Monitor` page (System->Monitor->DHCP Monitor) on the web-based interface which is accessible by the webui administrators. - The FortiOS webui accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. The redirect input parameter is also prone to a cross site scripting. Affected Software/OS: Fortinet FortiOS 5.0.0 prior to 5.0.13 and 5.2.0 prior to 5.2.4. Solution: Update to version 5.0.13, 5.2.4, 5.4.0 or later. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-3626 http://www.securitytracker.com/id/1033144
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.