CVEvulnerability

CVE-2022-42471

5.4 MEDIUM Published 2023-01-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-01-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-113, CWE-74

Description

An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.4.0 through 6.4.2, FortiWeb version 6.3.6 through 6.3.20 may allow an authenticated and remote attacker to inject arbitrary headers.

Affected configurations

• fortinet fortiweb (>= 6.3.6 <= 6.3.21) • fortinet fortiweb 6.4.0 • fortinet fortiweb 6.4.1 • fortinet fortiweb 6.4.2 • fortinet fortiweb 7.0.0 • fortinet fortiweb 7.0.1 • fortinet fortiweb 7.0.2

Related

Weakness · CWE (2)

  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References