CVE-2018-9186

6.1 mediumEPSS 0.7%

A cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2018-05-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortiauthenticator

References

http://www.securityfocus.com/bid/104371
https://fortiguard.com/advisory/FG-IR-18-059
http://www.securityfocus.com/bid/104371
https://fortiguard.com/advisory/FG-IR-18-059

Check your stack JSON