CVE-2022-42472
published 2023-02-16CVE-2022-42472: A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8…
PriorityP429medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.46%
37.1th percentile
A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortinet | — | — |
| fortinet | fortios | — | — |
| fortinet | fortios | — | — |
| fortinet | fortios | — | — |
| fortinet | fortios | — | — |
| fortinet | fortios | 6.0.0 – 6.0.16 | — |
| fortinet | fortios | 6.0.1 – 6.0.16 | — |
| fortinet | fortios | 6.2.0 – 6.2.12 | — |
| fortinet | fortios | 6.4.0 – 6.4.11 | — |
| fortinet | fortios | 7.0.0 – 7.0.8 | — |
| fortinet | fortios | 7.2.0 – 7.2.2 | — |
| fortinet | fortiproxy | — | — |
| fortinet | fortiproxy | — | — |
| fortinet | fortiproxy | — | — |
| fortinet | fortiproxy | 1.1.0 – 1.1.6 | — |
| fortinet | fortiproxy | 1.2.0 – 1.2.13 | — |
| fortinet | fortiproxy | 2.0.0 – 2.0.10 | — |
| fortinet | fortiproxy | 7.0.0 – 7.0.7 | — |
| fortinet | fortiproxy | 7.2.0 – 7.2.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2c29-h3hm-8953: A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7
ghsa_unreviewed·2023-02-16
CVE-2022-42472 [MEDIUM] CWE-436 GHSA-2c29-h3hm-8953: A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7
A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response.
Fortinet
Header injection in proxy login page
vendor_fortinet·2023-02-16·CVSS 4.2
CVE-2022-42472 [MEDIUM] CWE-113 Header injection in proxy login page
FG-IR-22-362: Header injection in proxy login page
A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response.
CVEs: CVE-2022-42472
CWEs: CWE-113, CWE-74
CVSS: 4.2 (medium)
Affected products: FortiOS, FortiProxy, Fortinet
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-02-16
Published