CVE-2022-42471: fortinet fortiweb HTTP Request/Response Splitting

Vulnerability summary

CVE-2022-42471 is a medium (CVSS 5.4) HTTP Request/Response Splitting vulnerability in fortinet fortiweb. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.1% of scored vulnerabilities.

Timeline

1. 03-01-2023
   PublishedVulnerability first disclosed.
2. 22-10-2024
   Last modifiedVulnerability information updated.

Description

An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.4.0 through 6.4.2, FortiWeb version 6.3.6 through 6.3.20 may allow an authenticated and remote attacker to inject arbitrary headers.

• CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.