CVE-2022-41330: XSS
First published: Tue Apr 11 2023(Updated: )
An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11 and before 6.2.12 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiProxy | >=7.0.0<7.0.8 | |
| Fortinet FortiProxy | >=7.2.0<7.2.2 | |
| Fortinet FortiOS | >=6.2.0<6.2.13 | |
| Fortinet FortiOS | >=6.4.0<6.4.12 | |
| Fortinet FortiOS | >=7.0.0<7.0.10 | |
| Fortinet FortiOS | >=7.2.0<7.2.4 |
Remedy
Please upgrade to FortiProxy version 7.2.2 or above Please upgrade to FortiProxy version 7.0.8 or above Please upgrade to FortiOS version 7.2.4 or above Please upgrade to FortiOS version 7.0.10 or above Please upgrade to FortiOS version 6.4.12 or above Please upgrade to FortiOS version 6.2.13 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-41330?
CVE-2022-41330 is an improper neutralization of input during web page generation vulnerability, also known as 'Cross-site Scripting' (CWE-79), affecting Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11, and versions before 6.2.12. It also affects FortiProxy version 7.2.0 through 7.2.1 and versions before 7.0.7.
What is the severity of CVE-2022-41330?
CVE-2022-41330 has a severity rating of 6.1 (high).
Which software versions are affected by CVE-2022-41330?
Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11, and versions before 6.2.12 are affected. FortiProxy version 7.2.0 through 7.2.1 and versions before 7.0.7 are also affected.
What is Cross-site Scripting (CWE-79)?
Cross-site Scripting (CWE-79) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
Where can I find more information about CVE-2022-41330?
You can find more information about CVE-2022-41330 at the Fortinet PSIRT advisory: https://fortiguard.com/psirt/FG-IR-22-363
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/author
- agent/weakness
- agent/type
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/fortinet
- canonical/fortinet fortiproxy
- version/fortinet fortiproxy/7.0.0
- version/fortinet fortiproxy/7.2.0
- canonical/fortinet fortios
- version/fortinet fortios/6.2.0
- version/fortinet fortios/6.4.0
- version/fortinet fortios/7.0.0
- version/fortinet fortios/7.2.0