Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2022-43955

An improper neutralization of input during web page generation [CWE-79] in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versions, 6.2 all versions,

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

An improper neutralization of input during web page generation [CWE-79] in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow an unauthenticated and remote attacker to perform a reflected cross site scripting attack (XSS) via injecting malicious payload in log entries used to build report.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiWeb

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.3affected
  • 6.4.0 to ≤ 6.4.2affected
  • 6.3.0 to ≤ 6.3.21affected
  • 6.2.0 to ≤ 6.2.7affected
  • 6.1.0 to ≤ 6.1.3affected
  • 6.0.0 to ≤ 6.0.8affected

References