CVE-2022-30304

2023-02-1619:15:12

CWE-79

[email protected]

web.nvd.nist.gov

cve-2022-30304

security vulnerability

cwe-79

fortianalyzer

stored xss

remote unauthenticated attack

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

45.7%

JSON

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting (XSS) attack via the URL parameter observed in the FortiWeb attack event logview in FortiAnalyzer.

Affected configurations

NVD

Node

fortinetfortianalyzerRange6.0.0–6.0.11

fortinetfortianalyzerRange6.2.0–6.2.9

fortinetfortianalyzerRange6.4.0–6.4.9

fortinetfortianalyzerRange7.0.0–7.0.5

fortinetfortianalyzerMatch7.2.0

fortinetfortianalyzerMatch7.2.1

CPENameOperatorVersion
fortinet:fortianalyzerfortinet fortianalyzerle6.0.11
fortinet:fortianalyzerfortinet fortianalyzerle6.2.9
fortinet:fortianalyzerfortinet fortianalyzerlt6.4.9
fortinet:fortianalyzerfortinet fortianalyzerlt7.0.5
fortinet:fortianalyzerfortinet fortianalyzereq7.2.0
fortinet:fortianalyzerfortinet fortianalyzereq7.2.1

CPE	Name	Operator	Version
fortinet:fortianalyzer	fortinet fortianalyzer	le	6.0.11
fortinet:fortianalyzer	fortinet fortianalyzer	le	6.2.9
fortinet:fortianalyzer	fortinet fortianalyzer	lt	6.4.9
fortinet:fortianalyzer	fortinet fortianalyzer	lt	7.0.5
fortinet:fortianalyzer	fortinet fortianalyzer	eq	7.2.0
fortinet:fortianalyzer	fortinet fortianalyzer	eq	7.2.1

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiAnalyzer",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.8",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.11",
        "status": "affected"
      }
    ]
  }
]