CVE-2021-32598: Medium severity fortinet fortianalyzer vulnerability
An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUI 7.0.0, 6.4.6 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this FortiManager and FortiAnalyzer GUI vulnerability?
The vulnerability ID for this FortiManager and FortiAnalyzer GUI vulnerability is CVE-2021-32598.
What is the severity of CVE-2021-32598?
The severity of CVE-2021-32598 is medium with a CVSS score of 4.3.
What is the affected software for CVE-2021-32598?
The affected software for CVE-2021-32598 includes FortiManager and FortiAnalyzer GUI versions 7.0.0, 6.4.6 and below, 6.2.8 and below, 6.0.11 and below, and 5.6.11 and below.
How can an attacker exploit CVE-2021-32598?
An attacker can exploit CVE-2021-32598 by performing an HTTP request splitting attack.
Is there a fix available for CVE-2021-32598?
Yes, Fortinet has released patches to address the CVE-2021-32598 vulnerability. It is recommended to update to the latest version of FortiManager and FortiAnalyzer GUI.