5.8
Medium
CVE-2022-38376 Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79]…
Description
Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiNAC 9.4 | 9.4.0 → 9.4.1 | No fix stated |
| FortiNAC 9.2 | 9.2.0 → 9.2.7 | No fix stated |
| FortiNAC 9.1 | 9.1.0 → 9.1.8 | No fix stated |
| FortiNAC 8.8 | 8.8.0 → 8.8.11 | No fix stated |
| FortiNAC 8.7 | 8.7.0 → 8.7.6 | No fix stated |
| FortiNAC 8.6 | 8.6.0 → 8.6.5 | No fix stated |
| FortiNAC 8.5 | 8.5.0 → 8.5.4 | No fix stated |
| FortiNAC | 8.3.7 | No fix stated |
Other CVEs of FortiNAC
The 23 CVEs of FortiNAC →
CVE-2023-33300
A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and…
4.8
Medium
CVE-2024-31488
An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through…
6.1
Medium
CVE-2023-26206
An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 -…
6.8
Medium
CVE-2023-33299
A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier…
9.6
Critical