CVE-2016-3196

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-08-05 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section.

Affected products

Fortinet Fortianalyzer Firmware: 5.0.0, 5.0.1, 5.0.4, 5.0.5, 5.0.10, 5.2.0 (+5)
Fortinet Fortimanager Firmware: 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8 (+8)

References

http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability
http://seclists.org/fulldisclosure/2016/Aug/4
http://www.securityfocus.com/archive/1/539069/100/0/threaded
http://www.securityfocus.com/bid/92203
http://www.securitytracker.com/id/1036550
http://www.securitytracker.com/id/1036551
http://www.vulnerability-lab.com/get_content.php?id=1687
http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability
http://seclists.org/fulldisclosure/2016/Aug/4
http://www.securityfocus.com/archive/1/539069/100/0/threaded
http://www.securityfocus.com/bid/92203
http://www.securitytracker.com/id/1036550

Get alerted when CVE-2016-3196 or the next vulnerability affects your stack