CVE-2017-7732

A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests.

Published: Oct 26, 2017
Updated: Nov 9, 2025
CVE: CVE-2017-7732
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
fortinet / fortimail	5.0.9	5.0.9.x
fortinet / fortimail	5.3.5	5.3.5.x
fortinet / fortimail	5.2.3	5.2.3.x
fortinet / fortimail	5.2.5	5.2.5.x
fortinet / fortimail	5.3.2	5.3.2.x
fortinet / fortimail	5.2	5.2.x
fortinet / fortimail	5.2.9	5.2.9.x
fortinet / fortimail	5.2.2	5.2.2.x
fortinet / fortimail	5.0.7	5.0.7.x
fortinet / fortimail	5.0.10	5.0.10.x
fortinet / fortimail	5.3.4	5.3.4.x
fortinet / fortimail	5.3	5.3.x
fortinet / fortimail	5.0.5	5.0.5.x
fortinet / fortimail	5.1	5.1.x
fortinet / fortimail	5.0	5.0.x
fortinet / fortimail	5.2.8	5.2.8.x
fortinet / fortimail	5.2.6	5.2.6.x
fortinet / fortimail	5.0.8	5.0.8.x
fortinet / fortimail	5.2.1	5.2.1.x
fortinet / fortimail	5.3.3	5.3.3.x
fortinet / fortimail	5.0.2	5.0.2.x
fortinet / fortimail	5.3.8	5.3.8.x
fortinet / fortimail	5.3.7	5.3.7.x
fortinet / fortimail	5.0.3	5.0.3.x
fortinet / fortimail	5.3.1	5.3.1.x
fortinet / fortimail	5.2.7	5.2.7.x
fortinet / fortimail	5.3.6	5.3.6.x
fortinet / fortimail	5.2.4	5.2.4.x
fortinet / fortimail	5.0.1	5.0.1.x
fortinet / fortimail	5.0.6	5.0.6.x
fortinet / fortimail	5.0.4	5.0.4.x
fortinet / fortimail	4.1.0	4.1.0.x
fortinet / fortimail	4.2.0	4.2.0.x
fortinet / fortimail	4.3.0	4.3.0.x
fortinet / fortimail	4.3.8	4.3.8.x
fortinet / fortimail	5.3.9	5.3.9.x

Vulnerability Database

311,379

CVE-2017-7732

Deep Security Visibility Without the Complexity