PT-2023-14410 · Fortinet · Fortiweb

Published 2023-04-11 · Updated 2023-04-18 · CVE-2022-43955

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiWeb versions 7.0.0 through 7.0.3 FortiWeb versions 6.3.0 through 6.3.21 FortiWeb versions 6.4 and earlier FortiWeb versions 6.2 and earlier FortiWeb versions 6.1 and earlier FortiWeb versions 6.0 and earlier

Description An improper neutralization of input during web page generation in the FortiWeb web interface may allow an unauthenticated and remote attacker to perform a reflected cross site scripting attack (XSS) via injecting malicious payload in log entries used to build report.

Recommendations For FortiWeb versions 7.0.0 through 7.0.3, update to a version outside of this range to mitigate the risk. For FortiWeb versions 6.3.0 through 6.3.21, update to a version outside of this range to mitigate the risk. For FortiWeb versions 6.4 and earlier, update to a version later than 6.4 to mitigate the risk. For FortiWeb versions 6.2 and earlier, update to a version later than 6.2 to mitigate the risk. For FortiWeb versions 6.1 and earlier, update to a version later than 6.1 to mitigate the risk. For FortiWeb versions 6.0 and earlier, update to a version later than 6.0 to mitigate the risk.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-43955

Affected Products

Fortiweb

References · 5

• https://osv.dev/vulnerability/CVE-2022-43955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43955 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-428 · Vendor Advisory
• https://t.me/cibsecurity/61893 · Telegram Post
• https://t.me/cvenotify/48503 · Telegram Post