PT-2022-5793 · Fortinet · Fortiadc

Published 2022-08-16 · Updated 2023-12-16 · CVE-2022-38374

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiADC versions 6.2.0 through 6.2.4 FortiADC versions 7.0.0 through 7.0.2

Description The issue is related to improper neutralization of input during web page generation, allowing an attacker to execute unauthorized code or commands. This can be achieved via the URL and User fields. The attacker can conduct cross-site scripting attacks by creating a specially crafted web page.

Recommendations For FortiADC versions 6.2.0 through 6.2.4, update to a version that includes the fix for this issue. For FortiADC versions 7.0.0 through 7.0.2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the URL and User fields in the traffic and event log views to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-07193

CVE-2022-38374

Affected Products

Fortiadc

References · 11

• 🔥 https://github.com/azhurtanov/CVE-2022-38374 · Exploit
• https://fortiguard.com/psirt/FG-IR-22-232 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07193 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-38374 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38374 · Vendor Advisory
• https://t.me/echeloneyes/850 · Telegram Post
• https://vuldb.com/?id.212806 · Note
• https://t.me/cybersecuritytechnologies/7247 · Telegram Post
• https://t.me/freedomf0x/18461 · Telegram Post
• https://t.me/breachdetector/200332 · Telegram Post
• https://t.me/breachdetector/400417 · Telegram Post