CVE-2022-33869 — Vulnetix

Try Vulnetix Request Demo

CVE-2022-33869 PUBLISHED CVSS 4.199999809265137 MEDIUM

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting (XSS) attack via the URL parameter observed in the FortiWeb attack event logview in FortiAnalyzer.

EPSS 1.29% · 79.5th percentile

Risk Scores

CVSS v3.1

4.199999809265137

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X

EPSS Score

1.29%

79.5th percentile

Affected Products

Vendor	Product	Versions
Fortinet	FortiAnalyzer	7.2.0, 7.0.0, 6.4.0

Timeline

Feb 16, 2023 CVE Published
Feb 17, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 28, 2023 EPSS Score
May 6, 2023 EPSS Score
Jun 14, 2023 EPSS Score
Aug 31, 2023 EPSS Score
Oct 9, 2023 EPSS Score
Nov 17, 2023 EPSS Score
Dec 26, 2023 EPSS Score
Feb 3, 2024 EPSS Score
Mar 13, 2024 EPSS Score

References

https://fortiguard.com/psirt/FG-IR-22-166 url

Open in Interactive Console →