Fortinet FortiAnalyzer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2022-30304)

Fortinet FortiAnalyzer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2022-30304)

Severity

6

CVSS

(AV:N/AC:M/Au:N/C:P/I:P/A:N)

Published

02/16/2023

Created

02/28/2023

Added

02/27/2023

Modified

01/28/2025

Description

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting (XSS) attack via the URL parameter observed in the FortiWeb attack event logview in FortiAnalyzer.

Solution(s)

• fortinet-fortianalyzer-upgrade-6_4_9
• fortinet-fortianalyzer-upgrade-7_0_5

References

• https://attackerkb.com/topics/cve-2022-30304
• CVE - 2022-30304
• https://fortiguard.com/psirt/FG-IR-22-166