Skip to content
OpenAdvisories
High · 8.0 CVE-2022-38373 EUVD-2022-40959GHSA-2mx3-6c3v-gprg

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0 th…

Published Nov 2, 2022 · Updated Oct 25, 2024 · Assigned by fortinet

Vendor: Fortinet Product: Fortinet FortiDeceptor Category: Network devices

Description

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0 through 4.1.1, 4.0.2 may allow an authenticated user to perform a cross site scripting (XSS) attack via sending requests with specially crafted lure resource ID.

Affected products

VendorProductAffectedFixed
Fortinet Fortinet FortiDeceptor FortiDeceptor 4.2.0, 4.1.0 through 4.1.1, 4.0.2 —

References