Lucene search

[email protected]CVE-2022-42471

HistoryJan 03, 2023 - 5:15 p.m.

CVE-2022-42471

2023-01-0317:15:10

CWE-74

CWE-113

[email protected]

web.nvd.nist.gov

cve-2022-42471

fortiweb

http response splitting

cwe-113

nvd

security vulnerability

injection attack

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:F/RL:U/RC:C

5.6 Medium

AI Score

Confidence

High

JSON

An improper neutralization of CRLF sequences in HTTP headers (‘HTTP Response Splitting’) vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.4.0 through 6.4.2, FortiWeb version 6.3.6 through 6.3.20 may allow an authenticated and remote attacker to inject arbitrary headers.

CPE configuration

NVD

fortinetfortiwebRange6.3.6–6.3.21

fortinetfortiwebMatch6.4.0

fortinetfortiwebMatch6.4.1

fortinetfortiwebMatch6.4.2

fortinetfortiwebMatch7.0.0

fortinetfortiwebMatch7.0.1

fortinetfortiwebMatch7.0.2

CPENameOperatorVersion
fortinet:fortiwebfortinet fortiweble6.3.21
fortinet:fortiwebfortinet fortiwebeq6.4.0
fortinet:fortiwebfortinet fortiwebeq6.4.1
fortinet:fortiwebfortinet fortiwebeq6.4.2
fortinet:fortiwebfortinet fortiwebeq7.0.0
fortinet:fortiwebfortinet fortiwebeq7.0.1
fortinet:fortiwebfortinet fortiwebeq7.0.2

CPE	Name	Operator	Version
fortinet:fortiweb	fortinet fortiweb	le	6.3.21
fortinet:fortiweb	fortinet fortiweb	eq	6.4.0
fortinet:fortiweb	fortinet fortiweb	eq	6.4.1
fortinet:fortiweb	fortinet fortiweb	eq	6.4.2
fortinet:fortiweb	fortinet fortiweb	eq	7.0.0
fortinet:fortiweb	fortinet fortiweb	eq	7.0.1
fortinet:fortiweb	fortinet fortiweb	eq	7.0.2

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiWeb",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.3.6",
        "lessThanOrEqual": "6.3.21",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-22-250

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:F/RL:U/RC:C

5.6 Medium

AI Score

Confidence

High

JSON

Related for CVE-2022-42471

prion1 cvelist1 nvd1