CVE-2014-1956: CRLF Injection
Published Apr 30, 2014
·Updated
CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Affected Software
1 affected component
Fortinet FortiWeb<=5.0.2
Event History
Apr 30, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:22 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-1956?
CVE-2014-1956 is considered a medium severity vulnerability due to its potential for remote exploitation.
2
How do I fix CVE-2014-1956?
To fix CVE-2014-1956, upgrade FortiWeb to version 5.0.3 or later.
3
What type of attacks can CVE-2014-1956 enable?
CVE-2014-1956 can enable HTTP response splitting attacks through CRLF injection.
4
Which versions of FortiWeb are affected by CVE-2014-1956?
FortiWeb versions prior to 5.0.3, specifically up to 5.0.2, are affected by CVE-2014-1956.
5
Who can exploit CVE-2014-1956?
Remote attackers can exploit CVE-2014-1956 if the vulnerable software is not updated.