PT-2023-14121 · Fortinet · Fortiweb

Published 2023-01-03 · Updated 2023-08-08 · CVE-2022-42471

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.3.6 through 6.3.20 FortiWeb versions 6.4.0 through 6.4.2 FortiWeb versions 7.0.0 through 7.0.2

Description The issue is related to an improper neutralization of CRLF sequences in HTTP headers, also known as 'HTTP Response Splitting'. This may allow an authenticated and remote attacker to inject arbitrary headers.

Recommendations For FortiWeb versions 6.3.6 through 6.3.20, update to a version that fixes the improper neutralization of CRLF sequences in HTTP headers. For FortiWeb versions 6.4.0 through 6.4.2, update to a version that fixes the improper neutralization of CRLF sequences in HTTP headers. For FortiWeb versions 7.0.0 through 7.0.2, update to a version that fixes the improper neutralization of CRLF sequences in HTTP headers.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-113

Related Identifiers

CVE-2022-42471

Affected Products

Fortiweb

References · 5

• https://osv.dev/vulnerability/CVE-2022-42471 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-22-250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42471 · Security Note
• https://t.me/cibsecurity/55815 · Telegram Post
• https://t.me/cvenotify/41202 · Telegram Post