CVE-2022-43955
Severity CVSS v4.0:
Pending analysis
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
11/04/2023
Last modified:
07/11/2023
Description
An improper neutralization of input during web page generation [CWE-79] in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow an unauthenticated and remote attacker to perform a reflected cross site scripting attack (XSS) via injecting malicious payload in log entries used to build report.
Impact
Base Score 3.x
6.10
Severity 3.x
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* | 6.0.0 (including) | 6.2.7 (including) |
cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* | 6.3.0 (including) | 6.3.22 (excluding) |
cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* | 6.4.0 (including) | 6.4.2 (including) |
cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* | 7.0.0 (including) | 7.0.4 (excluding) |
To consult the complete list of CPE names with products and versions, see this page