CVE-2022-30304: Fortinet Fortianalyzer

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting (XSS) attack via the URL parameter observed in the FortiWeb attack event logview in FortiAnalyzer.

Affected products

• Fortinet Fortianalyzer: from 6.0.0, up to and including 6.0.11; from 6.2.0, up to and including 6.2.9; from 6.4.0, before 6.4.9 (fixed in 6.4.9); from 7.0.0, before 7.0.5 (fixed in 7.0.5); version 7.2.0 only; version 7.2.1 only

Published 2023-02-16. Last modified 2026-06-17.