« Volver al listado

CVE-2020-12817

Estado: ModificadaAlta (8.8)—

An improper neutralization of input vulnerability in FortiAnalyzer before 6.4.1 and 6.2.5 may allow a remote authenticated attacker to inject script related HTML tags via Name parameter of Storage Connectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Fortinet — FortianalyzerFortinet — Fortitester

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-12817",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2020-12817",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-24T20:03:35.252097Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "Fortinet FortiAnalyzer",
          "versions": [
            {
              "status": "affected",
              "version": "FortiAnalyzer before 6.4.1; before 6.2.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-09-24T15:15:13.173",
  "references": [
    {
      "url": "https://fortiguard.com/advisory/FG-IR-20-054",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/advisory/FG-IR-20-054",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper neutralization of input vulnerability in FortiAnalyzer before 6.4.1 and 6.2.5 may allow a remote authenticated attacker to inject script related HTML tags via Name parameter of Storage Connectors."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de neutralización inapropiada de la entrada en FortiAnalyzer versiones anteriores a 6.4.1 y 6.2.5, puede permitir a un atacante autenticado remoto inyectar etiquetas HTML relacionadas con script por medio del parámetro Name de Conectores de Almacenamiento."
    }
  ],
  "lastModified": "2026-06-17T02:52:22.007",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:6.2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33BBFA56-466B-471F-AA74-0D8339CD2D6E"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:6.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA60D965-6F24-47E6-A62C-C147D51502A8"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:6.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F00DF5B2-FA3D-478B-834D-9A64194215CA"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortitester:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "888CBB49-6E71-496E-AC1E-02A55F8E796A",
              "versionEndIncluding": "3.7.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortitester:3.8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83A5237C-C126-4AEA-8CE8-DEC82DDEC69D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}