PT-2021-5487 · Fortinet · Fortimanager+1

Published 2021-05-08 · Updated 2021-08-12 · CVE-2021-32598

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiManager and FortiAnalyzer GUI versions 7.0.0, 6.4.6 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below

Description The issue is related to an improper neutralization of CRLF sequences in HTTP headers, also known as 'HTTP Response Splitting'. This may allow an authenticated and remote attacker to perform an HTTP request splitting attack, giving them control of the remaining headers and body of the response. The attacker can exploit this vulnerability to inject arbitrary HTTP headers.

Recommendations For FortiManager and FortiAnalyzer GUI versions 7.0.0, 6.4.6 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2021-06336

CVE-2021-32598

Affected Products

Fortianalyzer

Fortimanager

References · 6

• https://osv.dev/vulnerability/CVE-2021-32598 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06336 · Security Note
• https://fortiguard.com/advisory/FG-IR-21-063 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32598 · Security Note
• https://t.me/cibsecurity/26875 · Telegram Post
• https://t.me/cvenotify/18678 · Telegram Post