Vulnerability record · CVE-2017-3131 · published 12 September 2017

CVE-2017-3131: Fortinet fortios cross-site scripting vulnerability

Fortinet · Fortios

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView.

5.4 CVSS 3.0 Medium EPSS 7.7% · top 5.6% CWE-79 · Cross-site scripting

5.4CVSS 3.0 base score, v2 3.5

7.7%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Fortios Fortinet

References

Link	Tags
http://www.securityfocus.com/bid/100009	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039020	Third Party AdvisoryVDB Entry
https://fortiguard.com/advisory/FG-IR-17-104	MitigationVendor Advisory
https://www.exploit-db.com/exploits/42388/	Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/100009	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039020	Third Party AdvisoryVDB Entry
https://fortiguard.com/advisory/FG-IR-17-104	MitigationVendor Advisory
https://www.exploit-db.com/exploits/42388/	Third Party AdvisoryVDB Entry

Track CVE-2017-3131 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-24858Fortinet FortiCloud SSO authentication bypass across registered devicesA CWE-288 authentication bypass in Fortinet FortiAnalyzer, FortiManager, FortiNAC-F, FortiOS, FortiProxy and FortiWeb lets an attacker with a FortiCl…KEVEPSS 86%analysed27 Jan 2026 9.8CVE-2025-25249Fortinet FortiOS and FortiSwitchManager heap buffer overflow via crafted packetsA heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0 through 7.2.6 lets an unauthenticated…KEVEPSS 3.9%analysed13 Jan 2026 9.8CVE-2025-59718Fortinet FortiOS/FortiProxy SAML signature check bypass in FortiCloud SSOFortiOS, FortiProxy and FortiSwitchManager fail to properly verify the cryptographic signature of SAML responses used for FortiCloud SSO login. An un…KEVEPSS 68%analysed9 Dec 2025 9.8CVE-2024-55591FortiOS and FortiProxy authentication bypass via Node.js websocketFortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 contain an authentication bypass (CWE-288) reachable throug…KEVEPSS 94%analysed14 Jan 2025 9.8CVE-2024-23113Fortinet FortiOS and related products format string remote code executionA use of externally-controlled format string (CWE-134) in Fortinet FortiOS, FortiProxy, FortiPAM and FortiSwitchManager lets an attacker execute unau…KEVEPSS 62%analysed15 Feb 2024 9.8CVE-2024-21762Fortinet FortiOS and FortiProxy out-of-bounds write in SSL VPNFortiOS and FortiProxy contain an out-of-bounds write (CWE-787) reachable through specifically crafted requests. The flaw affects a wide range of For…KEVEPSS 83%analysed9 Feb 2024 9.8CVE-2023-27997Fortinet FortiOS and FortiProxy SSL-VPN heap buffer overflowFortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow (CWE-122/CWE-787) reachable through specifically crafted requests. It is a pre-au…KEVEPSS 86%analysed13 Jun 2023 9.8CVE-2022-42475FortiOS and FortiProxy SSL-VPN heap buffer overflow allows remote code executionA heap-based buffer overflow (CWE-122/CWE-787) in the FortiOS and FortiProxy SSL-VPN component lets a remote attacker trigger memory corruption throu…KEVEPSS 99%analysed2 Jan 2023

Source: NIST National Vulnerability Database (record CVE-2017-3131), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.