Vulnerability in Fortinet Fortios
CVE-2022-42472
A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response.
EPSS: 0.005 (37.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Fortinet Fortios — versions 6.4.0, 6.0.0, 7.0.0
- Fortinet Fortiproxy — versions 7.0.0, 7.2.1, 7.2.0
Weakness classification (CWE)
References
- psirt@fortinet.com (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-42472?
- CVE-2022-42472 is a medium-severity vulnerability in Fortinet Fortios, classified under HTTP Response Splitting. CVSS score: 4.2/10. Published 2023-02-16.
- How severe is CVE-2022-42472?
- Medium severity. CVSS v3 base score is 4.2 out of 10.