Lucene search

FortinetCVE-2022-38373

HistoryNov 02, 2022 - 12:15 p.m.

CVE-2022-38373

2022-11-0212:15:54

CWE-79

fortinet

web.nvd.nist.gov

cve-2022-38373

cwe-79

fortideceptor

xss

web security

nvd

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RC:R

EPSS

0.001

Percentile

22.7%

JSON

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0 through 4.1.1, 4.0.2 may allow an authenticated user to perform a cross site scripting (XSS) attack via sending requests with specially crafted lure resource ID.

Affected configurations

Nvd

Node

fortinetfortideceptorMatch4.0.2

fortinetfortideceptorMatch4.1.0

fortinetfortideceptorMatch4.1.1

fortinetfortideceptorMatch4.2.0

VendorProductVersionCPE
fortinetfortideceptor4.0.2cpe:2.3:a:fortinet:fortideceptor:4.0.2:*:*:*:*:*:*:*
fortinetfortideceptor4.1.0cpe:2.3:a:fortinet:fortideceptor:4.1.0:*:*:*:*:*:*:*
fortinetfortideceptor4.1.1cpe:2.3:a:fortinet:fortideceptor:4.1.1:*:*:*:*:*:*:*
fortinetfortideceptor4.2.0cpe:2.3:a:fortinet:fortideceptor:4.2.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortideceptor	4.0.2	cpe:2.3:a:fortinet:fortideceptor:4.0.2:::::::*
fortinet	fortideceptor	4.1.0	cpe:2.3:a:fortinet:fortideceptor:4.1.0:::::::*
fortinet	fortideceptor	4.1.1	cpe:2.3:a:fortinet:fortideceptor:4.1.1:::::::*
fortinet	fortideceptor	4.2.0	cpe:2.3:a:fortinet:fortideceptor:4.2.0:::::::*

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "Fortinet FortiDeceptor",
    "versions": [
      {
        "version": "FortiDeceptor 4.2.0, 4.1.0 through 4.1.1, 4.0.2",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-22-331

Social References

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RC:R

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2022-38373