8.0
High
CVE-2022-39950 An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and…
Description
An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0 through 6.4.8, and 7.0.0 through 7.0.4. Report templates may allow a low privilege level attacker to perform an XSS attack via posting a crafted CKeditor "protected" comment as described in CVE-2020-9281.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fortinet FortiAnalyzer, FortiManager | Versions not published |
References
- fortiguard.com fortiguard.com
Timeline
- Published
- Last modified
Other CVEs of Fortinet FortiAnalyzer, FortiManager
The 6 CVEs of Fortinet FortiAnalyzer, FortiManager →
CVE-2021-32587
An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8…
4.3
Medium
CVE-2021-32597
Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions…
4.6
Medium
CVE-2021-32603
A server-side request forgery (SSRF) (CWE-918) vulnerability in FortiManager and FortiAnalyser GUI 7.0.0, 6.4.5 and…
8.8
High
CVE-2021-32598
An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager…
4.3
Medium