CVE-2023-22638: XSS
First published: Thu Feb 16 2023(Updated: )
Several improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below, 8.6.5 and below, 8.5.4 and below, 8.3.7 and below may allow an authenticated attacker to perform several XSS attacks via crafted HTTP GET requests.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiNAC | >=8.5.0<=8.5.4 | |
| Fortinet FortiNAC | >=8.6.0<=8.6.5 | |
| Fortinet FortiNAC | >=8.7.0<=8.7.6 | |
| Fortinet FortiNAC | >=8.8.0<=8.8.11 | |
| Fortinet FortiNAC | >=9.1.0<=9.1.9 | |
| Fortinet FortiNAC | >=9.2.0<=9.2.7 | |
| Fortinet FortiNAC | =8.3.7 | |
| Fortinet FortiNAC | =9.4.0 | |
| Fortinet FortiNAC | =9.4.1 |
Remedy
Please upgrade to FortiNAC-F version 7.2.0 or above, Please upgrade to FortiNAC version 9.4.2 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this FortiNAC vulnerability?
The vulnerability ID is CVE-2023-22638.
What is the severity of vulnerability CVE-2023-22638?
The severity of vulnerability CVE-2023-22638 is high.
What is the affected software for vulnerability CVE-2023-22638?
The affected software for vulnerability CVE-2023-22638 is FortiNAC versions 8.3.7 and below, 8.5.4 and below, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.9 and below, 9.2.7 and below, 9.4.0 and below, 9.4.1 and below.
What is the CWE ID for vulnerability CVE-2023-22638?
The CWE ID for vulnerability CVE-2023-22638 is CWE-79.
How can an attacker exploit vulnerability CVE-2023-22638?
An authenticated attacker can perform several XSS attacks by exploiting vulnerability CVE-2023-22638.
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/remedy
- collector/mitre-cve
- source/MITRE
- vendor/fortinet
- canonical/fortinet fortinac
- version/fortinet fortinac/8.5.0
- version/fortinet fortinac/8.5.4
- version/fortinet fortinac/8.6.0
- version/fortinet fortinac/8.6.5
- version/fortinet fortinac/8.7.0
- version/fortinet fortinac/8.7.6
- version/fortinet fortinac/8.8.0
- version/fortinet fortinac/8.8.11
- version/fortinet fortinac/9.1.0
- version/fortinet fortinac/9.1.9
- version/fortinet fortinac/9.2.0
- version/fortinet fortinac/9.2.7
- version/fortinet fortinac/8.3.7
- version/fortinet fortinac/9.4.0
- version/fortinet fortinac/9.4.1