CVE-2016-3978 describes an open redirect and cross-site scripting (XSS) vulnerability in the Web User Interface (WebUI) of FortiOS versions 5.0.x, 5.2.x, and 5.4.x. An unauthenticated remote attacker could exploit this by manipulating the "redirect" parameter in the login page to redirect users to arbitrary websites, facilitating phishing or XSS attacks. The vulnerability carries a CVSSv3 score of 6.1 (Medium), indicating a low attack complexity and requiring user interaction, but potentially impacting confidentiality and integrity. Its EPSS score is low, suggesting a low likelihood of exploitation in the wild. There is no evidence of active exploitation, nor are there Metasploit modules or ExploitDB entries. However, Nuclei templates exist for detecting this vulnerability. Community discussion and media coverage are minimal, which is typical for a large percentage of CVEs.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.0.0CPE matchmatch criteria | cpe:2.3:o:fortinet:fortios:5.0.0:*:*:*:*:*:*:* | ||
5.0.1CPE matchmatch criteria | cpe:2.3:o:fortinet:fortios:5.0.1:*:*:*:*:*:*:* | ||
5.0.2CPE matchmatch criteria | cpe:2.3:o:fortinet:fortios:5.0.2:*:*:*:*:*:*:* | ||
5.0.3CPE matchmatch criteria | cpe:2.3:o:fortinet:fortios:5.0.3:*:*:*:*:*:*:* | ||
5.0.4CPE matchmatch criteria | cpe:2.3:o:fortinet:fortios:5.0.4:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.