FortiAnalyzer XSS Store & Tag Injection on cert CA/CRL view page. Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-17-305 Final 1 1 2018-07-05T00:00:00 Current version 2018-07-05T00:00:00 2018-07-05T00:00:00 Javascript code and HTML tags can be injected into the CN value of CA and CRL certificates via the import CA and CRL certificates feature of the GUI. The injected code may be executed when the GUI administrator views the CA certificate details and browses CRL certificates when CN values are rendered. Execute unauthorized code or commands FortiManager 6.0.0, 5.6.4 and below.FortiAnalyzer 6.0.0, 5.6.4 and below. FortiManager: upgrade to 5.6.5 or 6.0.1FortiAnalyzer: upgrade to 5.6.5 or 6.0.1Workarounds:Restrain from uploading untrusted CA and CRL certificates and/or check the CA and CRL certificate content before uploading. Fortinet is pleased to thank independent researcher Hassan Kooshkaki and independent researcher Farid Heydari reporting this vulnerability under responsible disclosure. CVE-2017-17541 3.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X https://fortiguard.fortinet.com/psirt/FG-IR-17-305 FortiAnalyzer XSS Store & Tag Injection on cert CA/CRL view page. Reference>