CVE-2022-40676: XSS
First published: Tue Mar 07 2023(Updated: )
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized code or commands via specially crafted http requests.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiNAC | >=8.5.0<=8.5.4 | |
| Fortinet FortiNAC | >=8.6.0<=8.6.5 | |
| Fortinet FortiNAC | >=8.7.0<=8.7.6 | |
| Fortinet FortiNAC | >=8.8.0<=8.8.11 | |
| Fortinet FortiNAC | >=9.2.0<=9.2.5 | |
| Fortinet FortiNAC | =8.3.7 | |
| Fortinet FortiNAC | =9.4.0 |
Remedy
Please upgrade to FortiNAC version 9.4.1 or above Please upgrade to FortiNAC version 9.2.6 or above Please upgrade to FortiNAC version 9.1.9 or above Please upgrade to FortiNAC version 7.2.0 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Fortinet FortiNAC vulnerability?
The vulnerability ID for this Fortinet FortiNAC vulnerability is CVE-2022-40676.
What is the severity level of CVE-2022-40676?
The severity level of CVE-2022-40676 is high.
What is the affected software version range for CVE-2022-40676?
The affected software versions range from 8.3.7 to 9.4.0 of Fortinet FortiNAC.
What is the CWE ID for CVE-2022-40676?
The CWE ID for CVE-2022-40676 is 79.
How can I fix the cross-site scripting vulnerability in Fortinet FortiNAC?
To fix the cross-site scripting vulnerability in Fortinet FortiNAC, update to a version beyond the affected software versions range.
- collector/nvd-index
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/remedy
- agent/references
- agent/last-modified-date
- agent/author
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/fortinet
- canonical/fortinet fortinac
- version/fortinet fortinac/8.5.0
- version/fortinet fortinac/8.5.4
- version/fortinet fortinac/8.6.0
- version/fortinet fortinac/8.6.5
- version/fortinet fortinac/8.7.0
- version/fortinet fortinac/8.7.6
- version/fortinet fortinac/8.8.0
- version/fortinet fortinac/8.8.11
- version/fortinet fortinac/9.1.0
- version/fortinet fortinac/9.1.8
- version/fortinet fortinac/9.2.0
- version/fortinet fortinac/9.2.5
- version/fortinet fortinac/8.3.7
- version/fortinet fortinac/9.4.0