Stored cross-site scripting in replacement messages visualization Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-21-248 Final 1 1 2022-12-06T00:00:00 Current version 2022-12-06T00:00:00 2022-12-06T00:00:00 A improper neutralization of input during web page generation ('cross-site scripting') [CWE-79] in FortiOS may allow a privileged attacker to perform a stored XSS attack via storing malicious payloads in replacement messages. None Execute unauthorized code or commands FortiProxy 7.2 all versions are not affectedFortiProxy version 7.0.0 through 7.0.1FortiProxy 2.0 all versionsFortiProxy 1.2 all versionsFortiProxy 1.1 all versionsFortiOS 7.2 all versions are not affectedFortiOS version 7.0.0 through 7.0.3FortiOS version 6.4.0 through 6.4.9FortiOS version 6.2.2 through 6.2.17FortiOS version 6.0.7 through 6.0.18 Please upgrade to FortiProxy version 7.0.2 or abovePlease upgrade to FortiOS version 7.2.2Please upgrade to FortiOS version 7.0.7Please upgrade to FortiOS version 6.4.10 or above Fortinet is pleased to thank Thanh Nguyen, Artem and Wei Cong of FortiGuard Labs and Massimiliano Ferraresi, Massimiliano Brolli and TIM Security Red Team Research from TIM for reporting this vulnerability under responsible disclosure. FortiOS 7.0.3 FortiOS 7.0.2 FortiOS 7.0.1 FortiOS 7.0.0 FortiOS 6.4.9 FortiOS 6.4.8 FortiOS 6.4.7 FortiOS 6.4.6 FortiOS 6.4.5 FortiOS 6.4.4 FortiOS 6.4.3 FortiOS 6.4.2 FortiOS 6.4.1 FortiOS 6.4.0 FortiOS 6.2.17 FortiOS 6.2.16 FortiOS 6.2.15 FortiOS 6.2.14 FortiOS 6.2.13 FortiOS 6.2.12 FortiOS 6.2.11 FortiOS 6.2.10 FortiOS 6.2.9 FortiOS 6.2.8 FortiOS 6.2.7 FortiOS 6.2.6 FortiOS 6.2.5 FortiOS 6.2.4 FortiOS 6.2.3 FortiOS 6.2.2 FortiOS 6.0.18 FortiOS 6.0.17 FortiOS 6.0.16 FortiOS 6.0.15 FortiOS 6.0.14 FortiOS 6.0.13 FortiOS 6.0.12 FortiOS 6.0.11 FortiOS 6.0.10 FortiOS 6.0.9 FortiOS 6.0.8 FortiOS 6.0.7 FortiProxy 7.0.1 FortiProxy 7.0.0 FortiProxy 2.0.14 FortiProxy 2.0.13 FortiProxy 2.0.12 FortiProxy 2.0.11 FortiProxy 2.0.10 FortiProxy 2.0.9 FortiProxy 2.0.8 FortiProxy 2.0.7 FortiProxy 2.0.6 FortiProxy 2.0.5 FortiProxy 2.0.4 FortiProxy 2.0.3 FortiProxy 2.0.2 FortiProxy 2.0.1 FortiProxy 2.0.0 FortiProxy 1.2.13 FortiProxy 1.2.12 FortiProxy 1.2.11 FortiProxy 1.2.10 FortiProxy 1.2.9 FortiProxy 1.2.8 FortiProxy 1.2.7 FortiProxy 1.2.6 FortiProxy 1.2.5 FortiProxy 1.2.4 FortiProxy 1.2.3 FortiProxy 1.2.2 FortiProxy 1.2.1 FortiProxy 1.2.0 FortiProxy 1.1.6 FortiProxy 1.1.5 FortiProxy 1.1.4 FortiProxy 1.1.3 FortiProxy 1.1.2 FortiProxy 1.1.1 FortiProxy 1.1.0 CVE-2022-40680 FortiOS-7.0.3 FortiOS-7.0.2 FortiOS-7.0.1 FortiOS-7.0.0 FortiOS-6.4.9 FortiOS-6.4.8 FortiOS-6.4.7 FortiOS-6.4.6 FortiOS-6.4.5 FortiOS-6.4.4 FortiOS-6.4.3 FortiOS-6.4.2 FortiOS-6.4.1 FortiOS-6.4.0 FortiOS-6.2.17 FortiOS-6.2.16 FortiOS-6.2.15 FortiOS-6.2.14 FortiOS-6.2.13 FortiOS-6.2.12 FortiOS-6.2.11 FortiOS-6.2.10 FortiOS-6.2.9 FortiOS-6.2.8 FortiOS-6.2.7 FortiOS-6.2.6 FortiOS-6.2.5 FortiOS-6.2.4 FortiOS-6.2.3 FortiOS-6.2.2 FortiOS-6.0.18 FortiOS-6.0.17 FortiOS-6.0.16 FortiOS-6.0.15 FortiOS-6.0.14 FortiOS-6.0.13 FortiOS-6.0.12 FortiOS-6.0.11 FortiOS-6.0.10 FortiOS-6.0.9 FortiOS-6.0.8 FortiOS-6.0.7 FortiProxy-7.0.1 FortiProxy-7.0.0 FortiProxy-2.0.14 FortiProxy-2.0.13 FortiProxy-2.0.12 FortiProxy-2.0.11 FortiProxy-2.0.10 FortiProxy-2.0.9 FortiProxy-2.0.8 FortiProxy-2.0.7 FortiProxy-2.0.6 FortiProxy-2.0.5 FortiProxy-2.0.4 FortiProxy-2.0.3 FortiProxy-2.0.2 FortiProxy-2.0.1 FortiProxy-2.0.0 FortiProxy-1.2.13 FortiProxy-1.2.12 FortiProxy-1.2.11 FortiProxy-1.2.10 FortiProxy-1.2.9 FortiProxy-1.2.8 FortiProxy-1.2.7 FortiProxy-1.2.6 FortiProxy-1.2.5 FortiProxy-1.2.4 FortiProxy-1.2.3 FortiProxy-1.2.2 FortiProxy-1.2.1 FortiProxy-1.2.0 FortiProxy-1.1.6 FortiProxy-1.1.5 FortiProxy-1.1.4 FortiProxy-1.1.3 FortiProxy-1.1.2 FortiProxy-1.1.1 FortiProxy-1.1.0 3.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-21-248 Stored cross-site scripting in replacement messages visualization Reference>