CVE-2022-41330: Fortinet FortiOS

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11 and before 6.2.12 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.

Affected products

• Fortinet FortiOS: from 6.2.0, before 6.2.13 (fixed in 6.2.13); from 6.4.0, before 6.4.12 (fixed in 6.4.12); from 7.0.0, before 7.0.10 (fixed in 7.0.10); from 7.2.0, before 7.2.4 (fixed in 7.2.4)
• Fortinet FortiProxy: from 7.0.0, before 7.0.8 (fixed in 7.0.8); from 7.2.0, before 7.2.2 (fixed in 7.2.2)

Published 2023-04-11. Last modified 2026-06-17.