CVE-2022-41336 - An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiPortal versions 6.0.0 through 6.0.11 and all versions of 5.3, 5.2, 5.1, 5.0 management interface may allow a remote authenticated attacker to perform a stored cross site scripting (XSS) attack via sending request with specially crafted columnindex parameter

Back Back to CVE browser

MEDIUM

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiPortal versions 6.0.0 through 6.0.11 and all versions of 5.3, 5.2, 5.1, 5.0 management interface may allow a remote authenticated attacker to perform a stored cross site scripting (XSS) attack via sending request with specially crafted columnindex parameter

Published Jan 3, 2023

6.6

MEDIUM

CVSS 3.1

EPSS 0.57%

Description

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiPortal versions 6.0.0 through 6.0.11 and all versions of 5.3, 5.2, 5.1, 5.0 management interface may allow a remote authenticated attacker to perform a stored cross site scripting (XSS) attack via sending request with specially crafted columnindex parameter.

Affected products

Vendor Fortinet Product FortiPortal Default
unaffected
- Version
  5.0.0
  Status
  affected
  Constraints
  <=5.0.3
- Version
  5.1.0
  Status
  affected
  Constraints
  <=5.1.2
- Version
  5.2.0
  Status
  affected
  Constraints
  <=5.2.6
- Version
  5.3.0
  Status
  affected
  Constraints
  <=5.3.8
- Version
  6.0.0
  Status
  affected
  Constraints
  <=6.0.11