CVE-2022-40680: Stored cross-site scripting in replacement messages visualization
First published: Tue Dec 06 2022(Updated: )
A improper neutralization of input during web page generation ('cross-site scripting') [CWE-79] in FortiOS may allow a privileged attacker to perform a stored XSS attack via storing malicious payloads in replacement messages.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiOS | >=6.0.7<=6.0.15 | |
| Fortinet FortiOS | >=6.2.2<=6.2.12 | |
| Fortinet FortiOS | >=6.4.0<=6.4.9 | |
| Fortinet FortiOS | >=7.0.0<=7.0.3 |
Remedy
Please upgrade to FortiOS version 7.2.2 Please upgrade to FortiOS version 7.0.7 Please upgrade to FortiOS version 6.4.10 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-40680.
What is the severity of CVE-2022-40680?
The severity of CVE-2022-40680 is medium (5.4).
What software versions are affected by CVE-2022-40680?
Fortinet FortiOS versions 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9, and 7.0.0 - 7.0.3 are affected by CVE-2022-40680.
What is the impact of CVE-2022-40680?
CVE-2022-40680 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages.
Where can I find more information about CVE-2022-40680?
You can find more information about CVE-2022-40680 at the following link: https://fortiguard.com/psirt/FG-IR-21-248
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/weakness
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2022-40680
- collector/fortiguard-psirt
- agent/severity
- agent/references
- agent/title
- agent/first-publish-date
- agent/event
- agent/description
- agent/tags
- agent/trending
- vendor/fortinet
- canonical/fortinet fortios
- version/fortinet fortios/6.0.7
- version/fortinet fortios/6.0.15
- version/fortinet fortios/6.2.2
- version/fortinet fortios/6.2.12
- version/fortinet fortios/6.4.0
- version/fortinet fortios/6.4.9
- version/fortinet fortios/7.0.0
- version/fortinet fortios/7.0.3