CVE-2025-22855
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient before 7.4.1 may allow the EMS administrator to send messages con
Severity
Low 2.6
CVSS 3.1
Exploited
Not listed
EPSS
0.003
25.2th percentile
Discovered by
Not disclosed
Published
Apr 8, 2025
Assigned by fortinet
Description
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient before 7.4.1 may allow the EMS administrator to send messages containing javascript code.
Weakness: CWE-79
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiClient | Endpoint / EDR | cna-assigner |
Vendor-reported affected versions (1)
- Fortinet · FortiClientEMS
Vendor remediation
Please upgrade to FortiClientEMS version 7.4.3 or above