PT-2022-24396 · Fortinet · Fortisoar

Published 2022-12-06 · Updated 2022-12-07 · CVE-2022-38379

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiSOAR versions 7.0.0 through 7.0.3 FortiSOAR version 7.2.0

Description The issue is related to improper neutralization of input during web page generation, which may allow an authenticated attacker to inject HTML tags via input fields of various components within FortiSOAR.

Recommendations For FortiSOAR versions 7.0.0 through 7.0.3, consider restricting access to input fields of various components to minimize the risk of exploitation. For FortiSOAR version 7.2.0, consider restricting access to input fields of various components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-38379

Affected Products

Fortisoar

References · 5

• https://osv.dev/vulnerability/CVE-2022-38379 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-22-220 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38379 · Security Note
• https://t.me/cibsecurity/54077 · Telegram Post
• https://t.me/cvenotify/39301 · Telegram Post