Skip to content
Sign in
4.2 Medium

CVE-2022-35850 An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator…

Description

An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the "reset-password" page.

Affected products and versions

Product Affected versions Fixed in
FortiAuthenticator 6.4 6.4.0 → 6.4.4 No fix stated
FortiAuthenticator 6.3 6.3.0 → 6.3.3 No fix stated
FortiAuthenticator 6.2 6.2.0 → 6.2.2 No fix stated
FortiAuthenticator 6.1 6.1.0 → 6.1.3 No fix stated

Other CVEs of FortiAuthenticator

The 11 CVEs of FortiAuthenticator →
CVE-2025-53379 A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all… 7.0 High CVE-2026-44277 A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0,… 9.1 Critical CVE-2026-21743 A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all… 6.8 Medium CVE-2025-57823 A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6,… 2.6 Low
Track this CVE