Vulnerability Description
An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0 through 6.4.8, and 7.0.0 through 7.0.4. Report templates may allow a low privilege level attacker to perform an XSS attack via posting a crafted CKeditor "protected" comment as described in CVE-2020-9281.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortianalyzer | >= 6.0.0, <= 6.2.9 |
| Fortinet | Fortimanager | >= 6.0.0, <= 6.2.9 |
Related Weaknesses (CWE)
References
- https://fortiguard.com/psirt/FG-IR-21-228Vendor Advisory
- https://fortiguard.com/psirt/FG-IR-21-228Vendor Advisory
FAQ
What is CVE-2022-39950?
CVE-2022-39950 is a vulnerability with a CVSS score of 8.0 (HIGH). An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0 through 6.4.8, and 7.0.0 th...
How severe is CVE-2022-39950?
CVE-2022-39950 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-39950?
Check the references section above for vendor advisories and patch information. Affected products include: Fortinet Fortianalyzer, Fortinet Fortimanager.