CVE-2022-40680: 
FortiOS vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability identified as CVE-2022-40680 was discovered in Fortinet FortiOS versions 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9, and 7.0.0 - 7.0.3. The vulnerability was disclosed on December 6, 2022, and involves improper neutralization of input during web page generation that could allow privileged attackers to execute unauthorized code or commands through malicious payloads in replacement messages (NVD, Fortinet Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received varying CVSS severity ratings. The NVD assigned a CVSS v3.1 base score of 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Fortinet assessed it with a CVSS v3.1 base score of 4.0 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows privileged attackers to execute unauthorized code or commands by storing malicious payloads in replacement messages, potentially compromising the security of affected FortiOS systems (NVD).

The vulnerability requires a privileged attacker and user interaction to exploit. The attack complexity is rated as low by NVD but high by Fortinet, indicating some difficulty in successful exploitation (NVD).

Fortinet has addressed this vulnerability in updated versions of FortiOS. Users are advised to upgrade to versions newer than those affected (6.0.15, 6.2.12, 6.4.9, and 7.0.3) to mitigate the risk (Fortinet Advisory).