Summary
generated automatically from NVD dataFortinet FortiOS 5.0 Patch 7 build 4457 contains multiple cross-site scripting (CWE-79) flaws in its handling of CAPWAP Join requests. A remote authenticated user can inject arbitrary web script or HTML through the WTP Name or the WTP Active Software Version field. The issue has a CVSS v2.0 score of 3.5 (LOW), with a network attack vector and an integrity impact only.
NVD description
Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the (1) WTP Name or (2) WTP Active Software Version field in a CAPWAP Join request.
EPSS · FIRST.org
0.98%probability of exploitation in the next 30 days
Higher than 61% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 2 févr. 2015
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
References (10)
- http://www.fortiguard.com/advisory/FG-IR-15-002/Vendor Advisory
- http://www.fortiguard.com/advisory/FG-IR-15-002/Vendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-79
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.