CVE-2025-22855: EMS can send javascript code to client through messages
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in FortiClient may allow the EMS administrator to send messages containing javascript code.
Other sources
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient before 7.4.1 may allow the EMS administrator to send messages containing javascript code.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22855?
CVE-2025-22855 is rated as a medium severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2025-22855?
To mitigate CVE-2025-22855, upgrade Fortinet FortiClient to version 7.4.1 or later.
What is the impact of CVE-2025-22855?
The impact of CVE-2025-22855 allows an EMS administrator to send messages that can execute malicious JavaScript in affected versions.
Which versions of Fortinet FortiClient are affected by CVE-2025-22855?
CVE-2025-22855 affects all versions of Fortinet FortiClient prior to 7.4.1.
Who is primarily affected by CVE-2025-22855?
EMS administrators using Fortinet FortiClient older than version 7.4.1 are primarily affected by CVE-2025-22855.