{"id":"CVE-2022-41330","state":"PUBLISHED","title":"An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 throug","description":"An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11 and before 6.2.12 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.","publishedAt":"2023-04-11T16:05:38.973Z","updatedAt":"2024-10-23T14:30:33.980Z","severity":{"score":8.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiProxy","Fortinet FortiOS"],"affected":[{"vendor":"Fortinet","product":"FortiProxy","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.1","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.7","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiOS","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.3","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.9","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.11","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.12","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-22-363"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:50:37.819Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/41xxx/CVE-2022-41330.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-41330","state":"PUBLISHED","datePublished":"2023-04-11T16:05:38.973Z","dateUpdated":"2024-10-23T14:30:33.980Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2022-09-23T15:07:35.782Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11 and before 6.2.12 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests."}],"affected":[{"vendor":"Fortinet","product":"FortiProxy","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.1","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.7","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiOS","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.3","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.9","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.11","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.12","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-363","name":"https://fortiguard.com/psirt/FG-IR-22-363"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"Execute unauthorized code or commands","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-04-11T16:05:38.973Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiProxy version 7.2.2 or above\r\nPlease upgrade to FortiProxy version 7.0.8 or above\r\nPlease upgrade to FortiOS version 7.2.4 or above\r\nPlease upgrade to FortiOS version 7.0.10 or above\r\nPlease upgrade to FortiOS version 6.4.12 or above\r\nPlease upgrade to FortiOS version 6.2.13 or above"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-363","name":"https://fortiguard.com/psirt/FG-IR-22-363","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T12:42:46.261Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-23T14:11:25.297377Z","id":"CVE-2022-41330","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-23T14:30:33.980Z"}}]}}}