VYPR
← All advisories
High severity8.0NVD Advisory· Published Nov 2, 2022· Updated Jun 17, 2026

CVE-2022-38373

CVE-2022-38373

Description

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0 through 4.1.1, 4.0.2 may allow an authenticated user to perform a cross site scripting (XSS) attack via sending requests with specially crafted lure resource ID.

Affected products

6
  • Fortinet/FortiDeceptor6 versions
    cpe:2.3:a:fortinet:fortideceptor:4.0.2:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:fortinet:fortideceptor:4.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:fortinet:fortideceptor:4.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:fortinet:fortideceptor:4.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:fortinet:fortideceptor:4.2.0:*:*:*:*:*:*:*
    • (no CPE)range: 4.2.0, 4.1.0-4.1.1, 4.0.2
    • (no CPE)range: FortiDeceptor 4.2.0, 4.1.0 through 4.1.1, 4.0.2

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.