7.1
High
CVE-2022-40676 A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions…
Description
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized code or commands via specially crafted http requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiNAC | 9.4.0 | No fix stated |
| FortiNAC 9.2 | 9.2.0 → 9.2.5 | No fix stated |
| FortiNAC 9.1 | 9.1.0 → 9.1.8 | No fix stated |
| FortiNAC 8.8 | 8.8.0 → 8.8.11 | No fix stated |
| FortiNAC 8.7 | 8.7.0 → 8.7.6 | No fix stated |
| FortiNAC 8.6 | 8.6.0 → 8.6.5 | No fix stated |
| FortiNAC 8.5 | 8.5.0 → 8.5.4 | No fix stated |
| FortiNAC | 8.3.7 | No fix stated |
Other CVEs of FortiNAC
The 23 CVEs of FortiNAC →
CVE-2023-33300
A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and…
4.8
Medium
CVE-2024-31488
An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through…
6.1
Medium
CVE-2023-26206
An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 -…
6.8
Medium
CVE-2023-33299
A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier…
9.6
Critical