PT-2023-14410 · Fortinet · Fortiweb

Publicado 2023-04-11 · Atualizado 2023-04-18 · CVE-2022-43955

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiWeb versions 7.0.0 through 7.0.3 FortiWeb versions 6.3.0 through 6.3.21 FortiWeb versions 6.4 and earlier FortiWeb versions 6.2 and earlier FortiWeb versions 6.1 and earlier FortiWeb versions 6.0 and earlier

Description An improper neutralization of input during web page generation in the FortiWeb web interface may allow an unauthenticated and remote attacker to perform a reflected cross site scripting attack (XSS) via injecting malicious payload in log entries used to build report.

Recommendations For FortiWeb versions 7.0.0 through 7.0.3, update to a version outside of this range to mitigate the risk. For FortiWeb versions 6.3.0 through 6.3.21, update to a version outside of this range to mitigate the risk. For FortiWeb versions 6.4 and earlier, update to a version later than 6.4 to mitigate the risk. For FortiWeb versions 6.2 and earlier, update to a version later than 6.2 to mitigate the risk. For FortiWeb versions 6.1 and earlier, update to a version later than 6.1 to mitigate the risk. For FortiWeb versions 6.0 and earlier, update to a version later than 6.0 to mitigate the risk.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-43955

Produtos afetados

Fortiweb

Referências · 5

• https://t.me/cibsecurity/61893 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-43955 · Aviso do Fabricante
• https://t.me/cvenotify/48503 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-43955 · Nota de Segurança
• https://fortiguard.com/psirt/FG-IR-22-428 · Aviso do Fabricante