CVE-2022-35850: XSS

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2022-35850.

Q: What is the severity of CVE-2022-35850?

The severity of CVE-2022-35850 is medium with a CVSS score of 6.1.

Q: What is the CWE category of CVE-2022-35850?

The CWE category of CVE-2022-35850 is CWE-79.

Q: How can a remote unauthenticated attacker exploit CVE-2022-35850?

A remote unauthenticated attacker can exploit CVE-2022-35850 by triggering a reflected cross-site scripting (XSS) attack via certain HTML tags in a web page.

Published Apr 11, 2023

Updated

An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the "reset-password" page.

Affected Software

2 affected components

Fortinet FortiAuthenticator>=6.1.0<6.3.4

Fortinet FortiAuthenticator>=6.4.0<6.4.7

Remediation

Information

Please upgrade to FortiAuthenticator version 6.5.0 or above Please upgrade to FortiAuthenticator version 6.4.7 or above Please upgrade to FortiAuthenticator version 6.4.5 or above Please upgrade to FortiAuthenticator version 6.3.4 or above

Event History

Apr 11, 2023

CVE Published

via MITRE·04:07 PM

Data Sourced

via MITRE·04:07 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2022-35850.

What is the severity of CVE-2022-35850?

The severity of CVE-2022-35850 is medium with a CVSS score of 6.1.

What is the CWE category of CVE-2022-35850?

The CWE category of CVE-2022-35850 is CWE-79.

Which versions of FortiAuthenticator are affected by CVE-2022-35850?

FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, and all versions of 6.2 and 6.1 are affected by CVE-2022-35850.

How can a remote unauthenticated attacker exploit CVE-2022-35850?