4.2
Medium
CVE-2022-35850 An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator…
Description
An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the "reset-password" page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiAuthenticator 6.4 | 6.4.0 → 6.4.4 | No fix stated |
| FortiAuthenticator 6.3 | 6.3.0 → 6.3.3 | No fix stated |
| FortiAuthenticator 6.2 | 6.2.0 → 6.2.2 | No fix stated |
| FortiAuthenticator 6.1 | 6.1.0 → 6.1.3 | No fix stated |
References
- fortiguard.com fortiguard.com
Timeline
- Published
- Last modified
Other CVEs of FortiAuthenticator
The 11 CVEs of FortiAuthenticator →
CVE-2025-53379
A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all…
7.0
High
CVE-2026-44277
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0,…
9.1
Critical
CVE-2026-21743
A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all…
6.8
Medium
CVE-2025-57823
A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6,…
2.6
Low