CVE-2022-41330
En bref Sévérité HIGH 8.3 EPSS EPSS 0.65 % · centile 51 (2026-10-27) État PUBLISHED Publiée 2023-04-11 Mise à jour 2024-10-23 Attribuée par fortinet Statut NVD Modified Description An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11 and before 6.2.12 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.
Scores Version Score Vecteur Évalué par CVSS 3.1 HIGH 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C fortinet CVSS 3.1 HIGH 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H NVD · psirt@fortinet.com (Secondary) CVSS 3.1 MEDIUM 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.8cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.2cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 < 6.2.13cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 < 6.4.12cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.10cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.4Produits affectés Produit Versions Fortinet · FortiProxy affected 7.2.0 ≤ 7.2.1 ; affected 7.0.0 ≤ 7.0.7 Fortinet · FortiOS affected 7.2.0 ≤ 7.2.3 ; affected 7.0.0 ≤ 7.0.9 ; affected 6.4.0 ≤ 6.4.11 ; affected 6.2.0 ≤ 6.2.12
Références
Sources
