PT-2022-1389 · Fortinet · Fortianalyzer+1

Published 2022-11-01 · Updated 2022-11-03 · CVE-2022-39950

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiManager versions 6.0.0 through 7.0.4 FortiAnalyzer versions 6.0.0 through 7.0.4

Description The issue is related to an improper neutralization of input during web page generation, which may allow a low privilege level attacker to perform a cross-site scripting (XSS) attack. This can be achieved by posting a crafted CKeditor "protected" comment. The vulnerability can be exploited by a remote attacker to carry out cross-site scripting attacks.

Recommendations For FortiManager versions 6.0.0 through 7.0.4, update to a version that includes the fix for this issue. For FortiAnalyzer versions 6.0.0 through 7.0.4, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the report templates feature until a patch is available. Avoid using the CKeditor "protected" comment feature in the affected versions until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-05753

CVE-2022-39950

Affected Products

Fortianalyzer

Fortimanager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-39950 · Security Note
• https://fortiguard.com/psirt/FG-IR-21-228 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39950 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05753 · Security Note
• https://vuldb.com/ru/?ctiid.212810 · Note