CVE-2022-41330: XSS
An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11 and before 6.2.12 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2022-41330?
CVE-2022-41330 is an improper neutralization of input during web page generation vulnerability, also known as 'Cross-site Scripting' (CWE-79), affecting Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11, and versions before 6.2.12. It also affects FortiProxy version 7.2.0 through 7.2.1 and versions before 7.0.7.
What is the severity of CVE-2022-41330?
CVE-2022-41330 has a severity rating of 6.1 (high).
Which software versions are affected by CVE-2022-41330?
Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11, and versions before 6.2.12 are affected. FortiProxy version 7.2.0 through 7.2.1 and versions before 7.0.7 are also affected.
What is Cross-site Scripting (CWE-79)?
Cross-site Scripting (CWE-79) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
Where can I find more information about CVE-2022-41330?
You can find more information about CVE-2022-41330 at the Fortinet PSIRT advisory: https://fortiguard.com/psirt/FG-IR-22-363