PT-2023-13972 · Fortinet · Fortios

Published 2023-02-16 · Updated 2023-02-27 · CVE-2022-41334

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.0.0 through 7.0.7 FortiOS versions 7.2.0 through 7.2.3

Description The issue is related to an improper neutralization of input during web page generation, which may allow a remote, unauthenticated attacker to launch a cross site scripting (XSS) attack. This attack can be launched via the redir parameter of the URL seen when the "Sign in with FortiCloud" button is clicked.

Recommendations For FortiOS versions 7.0.0 through 7.0.7, update to a version outside of this range to mitigate the risk. For FortiOS versions 7.2.0 through 7.2.3, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the "Sign in with FortiCloud" button to minimize the risk of exploitation. Avoid using the redir parameter in the affected URL until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-41334

Affected Products

Fortios

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-41334 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-224 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41334 · Vendor Advisory