CVE-2022-30304 MEDIUM

CVE-2022-30304

Vendor Fortinet
Product FortiAnalyzer
Weakness CWE-79 · XSS
Published February 16, 2023
Last update October 22, 2024
View on NVD All CVEs

CVSS base score

4.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X

What the vulnerability does

01Description

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting (XSS) attack via the URL parameter observed in the FortiWeb attack event logview in FortiAnalyzer.

Key dates

02Disclosure timeline

February 16, 2023 CVE published
October 22, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-53834 Caido Toast Vulnerable to Reflected Cross-site Scripting CVE-2025-48258 WordPress Mega Menu Block plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerability CVE-2022-35275 WordPress Advanced Order Export For WooCommerce plugin <= 3.3.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability CVE-2025-41364 Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF CVE-2022-23519 Possible XSS vulnerability with certain configurations of rails-html-sanitizer