CVE-2022-35850

6.1 mediumEPSS 0.5%

Medium (6.1) in fortinet fortiauthenticator. EPSS 0.5% chance of exploitation in the next 30 days.

An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the "reset-password" page.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-80
Published: 2023-04-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortiauthenticator

References

https://fortiguard.com/psirt/FG-IR-22-275
https://fortiguard.com/psirt/FG-IR-22-275

Check your stack JSON