Lucene search

[email protected]CVE-2022-42472

HistoryFeb 16, 2023 - 7:15 p.m.

CVE-2022-42472

2023-02-1619:15:13

CWE-113

CWE-74

[email protected]

web.nvd.nist.gov

cve-2022-42472

http response splitting

fortinet

fortios

fortiproxy

security vulnerability

nvd

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.9%

JSON

A improper neutralization of crlf sequences in http headers (‘http response splitting’) in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response.

Affected configurations

NVD

Node

fortinetfortiproxyRange1.1.0–1.1.6

fortinetfortiproxyRange1.2.0–1.2.13

fortinetfortiproxyRange2.0.0–2.0.10

fortinetfortiproxyRange7.0.0–7.0.7

fortinetfortiproxyMatch7.2.0

fortinetfortiproxyMatch7.2.1

Node

fortinetfortiosRange6.0.1–6.0.16

fortinetfortiosRange6.2.0–6.2.12

fortinetfortiosRange6.4.0–6.4.11

fortinetfortiosRange7.0.0–7.0.8

fortinetfortiosMatch7.2.0

fortinetfortiosMatch7.2.1

fortinetfortiosMatch7.2.2

CPENameOperatorVersion
fortinet:fortiproxyfortinet fortiproxyle1.1.6
fortinet:fortiproxyfortinet fortiproxyle1.2.13
fortinet:fortiproxyfortinet fortiproxyle2.0.10
fortinet:fortiproxyfortinet fortiproxyle7.0.7
fortinet:fortiproxyfortinet fortiproxyeq7.2.0
fortinet:fortiproxyfortinet fortiproxyeq7.2.1

CPE	Name	Operator	Version
fortinet:fortiproxy	fortinet fortiproxy	le	1.1.6
fortinet:fortiproxy	fortinet fortiproxy	le	1.2.13
fortinet:fortiproxy	fortinet fortiproxy	le	2.0.10
fortinet:fortiproxy	fortinet fortiproxy	le	7.0.7
fortinet:fortiproxy	fortinet fortiproxy	eq	7.2.0
fortinet:fortiproxy	fortinet fortiproxy	eq	7.2.1

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiProxy",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "2.0.0",
        "lessThanOrEqual": "2.0.10",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "1.2.0",
        "lessThanOrEqual": "1.2.13",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "1.1.0",
        "lessThanOrEqual": "1.1.6",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiOS",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.8",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.11",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.12",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.16",
        "status": "affected"
      }
    ]
  }
]