Lucene search

FortinetCVE-2022-43955

HistoryApr 11, 2023 - 5:15 p.m.

CVE-2022-43955

2023-04-1117:15:07

CWE-79

fortinet

web.nvd.nist.gov

cve-2022-43955

cwe-79

fortiweb

xss

input neutralization

remote code execution

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RC:R

EPSS

0.001

Percentile

32.9%

JSON

An improper neutralization of input during web page generation [CWE-79] in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow an unauthenticated and remote attacker to perform a reflected cross site scripting attack (XSS) via injecting malicious payload in log entries used to build report.

Affected configurations

Nvd

Node

fortinetfortiwebRange6.0.0–6.2.7

fortinetfortiwebRange6.3.0–6.3.22

fortinetfortiwebRange6.4.0–6.4.2

fortinetfortiwebRange7.0.0–7.0.4

VendorProductVersionCPE
fortinetfortiweb*cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiweb	*	cpe:2.3:a:fortinet:fortiweb::::::::

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiWeb",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.3",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.3.0",
        "lessThanOrEqual": "6.3.21",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.1.0",
        "lessThanOrEqual": "6.1.3",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.8",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-22-428

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RC:R

EPSS

0.001

Percentile

32.9%

JSON

Related for CVE-2022-43955