CVE-2022-40676

{"id": "CVE-2022-40676", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2023-03-07T17:15:12.020", "references": [{"url": "https://fortiguard.com/psirt/FG-IR-22-281", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized code or commands via specially crafted http requests."}], "lastModified": "2023-11-07T03:52:34.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8292B841-851C-42C2-AF13-17AB2FA894CD", "versionEndIncluding": "8.5.4", "versionStartIncluding": "8.5.0"}, {"criteria": "cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95E75B88-1750-4FB6-BCE4-74B69D93C918", "versionEndIncluding": "8.6.5", "versionStartIncluding": "8.6.0"}, {"criteria": "cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BD32B25-76B4-4D6E-BB5C-065070297058", "versionEndIncluding": "8.7.6", "versionStartIncluding": "8.7.0"}, {"criteria": "cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46929BE3-0396-4B8A-9889-9F6CA73FAD4E", "versionEndIncluding": "8.8.11", "versionStartIncluding": "8.8.0"}, {"criteria": "cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DFD62C8-07EF-4C7C-B18B-414A9C4A2955", "versionEndIncluding": "9.1.8", "versionStartIncluding": "9.1.0"}, {"criteria": "cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "561003C4-0B6E-4088-8272-03C6574B83F4", "versionEndIncluding": "9.2.5", "versionStartIncluding": "9.2.0"}, {"criteria": "cpe:2.3:a:fortinet:fortinac:8.3.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "952F266E-0E48-4D69-81E0-9F813B60AC3E"}, {"criteria": "cpe:2.3:a:fortinet:fortinac:9.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E12E11B0-E21A-4124-9DF9-FF268BB19813"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}