CVE-2015-3620: Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0...

Security readout for executives and security teams

This CVE is a cross-site scripting issue in Fortinet FortiAnalyzer and FortiManager report functionality. An attacker could cause the web interface to render attacker-controlled script or HTML. The main business risk is compromise of administrator browser sessions or manipulation of management-console content if a vulnerable interface is reachable and an administrator is exposed. Exposure is most likely where legacy FortiAnalyzer or FortiManager web management interfaces remain deployed, especially if reachable beyond trusted administration networks. The supplied record does not identify cloud services, default internet exposure, or affected versions outside the named 5.0 and 5.2 branches. Treat this as a targeted legacy management-plane risk. Prioritize if affected Fortinet management consoles are still in use or reachable by broad internal users. It is not currently supported by the provided evidence as an emergency active-exploitation issue. Mitigation focus: Check Fortinet advisory FG-IR-15-005 for vendor-confirmed fixed versions and upgrade guidance.; Restrict FortiAnalyzer and FortiManager web access to trusted management networks or VPN users.; Remove or isolate unsupported legacy 5.0 and 5.2 deployments..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.