CVE-2022-38374
Published: 02 November 2022
Summary
CVE-2022-38374 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Fortinet Fortiadc. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 4.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a cross-site scripting flaw (CWE-79) arising from improper neutralization of input during web page generation in Fortinet FortiADC. It affects versions 7.0.0–7.0.2 and 6.2.0–6.2.4, specifically in the traffic and event log views where URL and User fields are rendered.
An unauthenticated remote attacker can supply crafted values in those fields that are later displayed in the logs. When an administrator views the affected log pages, the malicious script executes in the browser context, enabling the attacker to run unauthorized code or commands with high impact on confidentiality, integrity, and availability.
The issue is tracked in Fortinet advisory FG-IR-22-232. The EPSS score has remained flat at 0.1668 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-40960
Vulnerability details
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic…
more
and event logviews.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.