Vulnerability · Published Apr 11, 2023 · Assigned by fortinet
CVE-2022-41330
High 8.3
In plain English
A high-severity cross-site scripting in FortiOS from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Official description
An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11 and before 6.2.12 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiProxy | 7.2.0 – through 7.2.17.0.0 – through 7.0.7 |
| Fortinet | FortiOS | 7.2.0 – through 7.2.37.0.0 – through 7.0.96.4.0 – through 6.4.116.2.0 – through 6.2.12 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C