CVE-2022-22304

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAuthenticator OWA Agent for Microsoft version 2.2 and 2.1 may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
FortinetFortinet FortiAuthenticator OutlookAgentFortiAuthenticator Agent for Microsoft OWA version 2.2 and 2.1.

References

Timeline

Published
Jul 18, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-223054.2An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, CVE-2022-223065.3An improper certificate validation vulnerability [CWE-295] in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0CVE-2022-223077.8IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect authorization checks. IBCVE-2022-223087.8IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed into file include commands and thCVE-2022-223096.8The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more criticalCVE-2022-22315.5NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.CVE-2022-223106.5IBM WebSphere Application Server Liberty 21.0.0.10 through 21.0.0.12 could provide weaker than expected security. A remote attacker could exCVE-2022-223116.5IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some iCVE-2022-223126.5IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable to a denial of servicCVE-2022-223137.5IBM QRadar Data Synchronization App 1.0 through 3.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decCVE-2022-223143.3IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 2173CVE-2022-223158.8IBM UrbanCode Deploy (UCD) 7.2.2.1 could allow an authenticated user with special permissions to obtain elevated privileges due to improper
CVE-2022-22304: Medium severity, CVSS 6.1 | Vulnix