CVE-2022-40680

published 2022-12-06

CVE-2022-40680: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and…

Priority P4 25 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortinet	—	—
fortinet	fortios	—	—
fortinet	fortios	6.0.7 – 6.0.15	—
fortinet	fortios	6.2.2 – 6.2.12	—
fortinet	fortios	6.4.0 – 6.4.9	—
fortinet	fortios	7.0.0 – 7.0.3	—
fortinet	fortiproxy	1.1.0 – 1.1.6	—
fortinet	fortiproxy	1.2.0 – 1.2.13	—
fortinet	fortiproxy	2.0.0 – 2.0.11	—
fortinet	fortiproxy	7.0.0 – 7.0.1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79