PT-2023-7426 · Fortinet · Fortiproxy+1

CVE-2022-42472 · Publicado 2023-02-16 · Atualizado 2023-08-08

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.0.0 through 6.0.16 FortiOS versions 6.2.0 through 6.2.12 FortiOS versions 6.4.0 through 6.4.11 FortiOS versions 7.0.0 through 7.0.8 FortiOS versions 7.2.0 through 7.2.2 FortiProxy versions 1.1.0 through 1.1.6 FortiProxy versions 1.2.0 through 1.2.13 FortiProxy versions 2.0.0 through 2.0.10 FortiProxy versions 7.0.0 through 7.0.7 FortiProxy versions 7.2.0 through 7.2.1

Description The issue is related to an improper neutralization of CRLF sequences in HTTP headers, also known as 'HTTP Response Splitting'. This may allow an authenticated and remote attacker to perform an HTTP request splitting attack, giving them control over the remaining headers and body of the response. The attacker can inject arbitrary HTTP headers.

Recommendations For FortiOS versions 6.0.0 through 6.0.16, update to a version that fixes the HTTP Response Splitting issue. For FortiOS versions 6.2.0 through 6.2.12, update to a version that fixes the HTTP Response Splitting issue. For FortiOS versions 6.4.0 through 6.4.11, update to a version that fixes the HTTP Response Splitting issue. For FortiOS versions 7.0.0 through 7.0.8, update to a version that fixes the HTTP Response Splitting issue. For FortiOS versions 7.2.0 through 7.2.2, update to a version that fixes the HTTP Response Splitting issue. For FortiProxy versions 1.1.0 through 1.1.6, update to a version that fixes the HTTP Response Splitting issue. For FortiProxy versions 1.2.0 through 1.2.13, update to a version that fixes the HTTP Response Splitting issue. For FortiProxy versions 2.0.0 through 2.0.10, update to a version that fixes the HTTP Response Splitting issue. For FortiProxy versions 7.0.0 through 7.0.7, update to a version that fixes the HTTP Response Splitting issue. For FortiProxy versions 7.2.0 through 7.2.1, update to a version that fixes the HTTP Response Splitting issue. As a temporary workaround, consider restricting access to HTTP endpoints to minimize the risk of exploitation.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

CWE-113

Identificadores relacionados

BDU:2023-08463

CVE-2022-42472

Produtos afetados

Fortios

Fortiproxy

Referências · 4

• https://fortiguard.com/psirt/FG-IR-22-362 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-08463 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-42472 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-42472 · Nota de Segurança