CVE-2022-38379: XSS
Published Dec 6, 2022
·Updated
Improper neutralization of input during web page generation [CWE-79] in FortiSOAR 7.0.0 through 7.0.3 and 7.2.0 may allow an authenticated attacker to inject HTML tags via input fields of various components within FortiSOAR.
Affected Software
2 affected components
Fortinet FortiSOAR>=7.0.0<=7.0.3
Fortinet FortiSOAR=7.2.0
Remediation
Information
Please upgrade to FortiSOAR version 7.2.1 or above
Event History
Dec 6, 2022
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-38379?
CVE-2022-38379 has a medium severity rating due to the potential for HTML injection attacks.
2
How do I fix CVE-2022-38379?
You can remediate CVE-2022-38379 by upgrading FortiSOAR to version 7.0.4 or later.
3
What versions of FortiSOAR are affected by CVE-2022-38379?
CVE-2022-38379 affects FortiSOAR versions 7.0.0 through 7.0.3 and version 7.2.0.
4
Can CVE-2022-38379 be exploited remotely?
CVE-2022-38379 requires authenticated access, meaning exploitation is not possible remotely without user credentials.
5
What type of vulnerability is CVE-2022-38379?
CVE-2022-38379 is classified as an improper neutralization of input during web page generation, specifically allowing HTML injection.