SID 1:45401

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Fortinet FortiOS redir parameter cross site scripting attempt

Rule Explanation

This event is generated when an authenticated user injects arbitrary web code or HTML in the context of the victim's browser via the login redir parameter. Impact: Allows unauthorized modification Details: An URL Redirection Attack may also enable an authenticated user to redirect the victim to an arbitrary URL, via the redir parameter. The rule checks for these issues within the redir parameter. Ease of Attack: Medium; Authentication is required to exploit

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group