{"id":"CVE-2022-35850","state":"PUBLISHED","title":"An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of","description":"An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the \"reset-password\" page.","publishedAt":"2023-04-11T16:07:22.760Z","updatedAt":"2024-10-22T20:46:56.508Z","severity":{"score":4.2,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:F/RL:U/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiAuthenticator"],"affected":[{"vendor":"Fortinet","product":"FortiAuthenticator","defaultStatus":"unaffected","versions":[{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.4","versionType":"semver"},{"version":"6.3.0","status":"affected","lessThanOrEqual":"6.3.3","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.2","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThanOrEqual":"6.1.3","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-22-275"],"weaknesses":["CWE-80"],"ingestedAt":"2026-10-29T19:50:17.761Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/35xxx/CVE-2022-35850.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-35850","state":"PUBLISHED","datePublished":"2023-04-11T16:07:22.760Z","dateUpdated":"2024-10-22T20:46:56.508Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2022-07-13T20:38:49.334Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the \"reset-password\" page."}],"affected":[{"vendor":"Fortinet","product":"FortiAuthenticator","defaultStatus":"unaffected","versions":[{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.4","versionType":"semver"},{"version":"6.3.0","status":"affected","lessThanOrEqual":"6.3.3","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.2","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThanOrEqual":"6.1.3","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-275","name":"https://fortiguard.com/psirt/FG-IR-22-275"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:F/RL:U/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-80","lang":"en","description":"Execute unauthorized code or commands","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-04-11T16:07:22.760Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiAuthenticator version 6.5.0 or above Please upgrade to FortiAuthenticator version 6.4.7 or above Please upgrade to FortiAuthenticator version 6.4.5 or above Please upgrade to FortiAuthenticator version 6.3.4 or above "}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-275","name":"https://fortiguard.com/psirt/FG-IR-22-275","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T09:44:22.012Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-22T20:18:11.120911Z","id":"CVE-2022-35850","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-22T20:46:56.508Z"}}]}}}