CVE-2022-41334: XSS
An improper neutralization of input during web page generation [CWE-79] vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 may allow a remote, unauthenticated attacker to launch a cross site scripting (XSS) attack via the "redir" parameter of the URL seen when the "Sign in with FortiCloud" button is clicked.
Affected Software
Remediation
Patch Available
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41334?
The severity of CVE-2022-41334 is high.
What is the vulnerability type of CVE-2022-41334?
CVE-2022-41334 is an improper neutralization of input during web page generation (CWE-79) vulnerability.
Which versions of FortiOS are affected by CVE-2022-41334?
FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 are affected by CVE-2022-41334.
How can a remote attacker exploit CVE-2022-41334?
A remote, unauthenticated attacker can exploit CVE-2022-41334 by launching a cross-site scripting (XSS) attack via the "redir" parameter of the URL associated with "Sign in with Fort..." feature.
Is there a fix available for CVE-2022-41334?
Yes, Fortinet has released fixes to address the vulnerability. It is recommended to update to the latest version of FortiOS.