What’s Vulnerable › Vulnerabilities

CVE-2022-30304

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-16 · updated 2026-06-17
• Weakness: CWE-79

Description

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting (XSS) attack via the URL parameter observed in the FortiWeb attack event logview in FortiAnalyzer.

Affected products

• Fortinet FortiAnalyzer: from 6.0.0 through 6.0.11; from 6.2.0 through 6.2.9; from 6.4.0 before 6.4.9; from 7.0.0 before 7.0.5; 7.2.0, 7.2.1 — fixed in 6.4.9, 7.0.5

How to fix

Upgrade to a fixed version: Fortinet FortiAnalyzer 6.4.9, 7.0.5. Check the vendor advisory for mitigations.

References

• https://fortiguard.com/psirt/FG-IR-22-166
• https://fortiguard.com/psirt/FG-IR-22-166

Get alerted when CVE-2022-30304 or the next vulnerability affects your stack