CVE-2022-41330
At a glance Severity HIGH 8.3 EPSS EPSS 0.65 % · percentile 51 (2026-10-27) State PUBLISHED Published 2023-04-11 Updated 2024-10-23 Assigner fortinet NVD status Modified Description An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11 and before 6.2.12 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C fortinet CVSS 3.1 HIGH 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H NVD · psirt@fortinet.com (Secondary) CVSS 3.1 MEDIUM 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.8cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.2cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 < 6.2.13cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 < 6.4.12cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.10cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.4Affected products Product Versions Fortinet · FortiProxy affected 7.2.0 ≤ 7.2.1 ; affected 7.0.0 ≤ 7.0.7 Fortinet · FortiOS affected 7.2.0 ≤ 7.2.3 ; affected 7.0.0 ≤ 7.0.9 ; affected 6.4.0 ≤ 6.4.11 ; affected 6.2.0 ≤ 6.2.12
References
Sources
