CVE-2022-42471: Medium severity fortinet fortiweb vulnerability
Published Jan 3, 2023
·Updated
An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.4.0 through 6.4.2, FortiWeb version 6.3.6 through 6.3.20 may allow an authenticated and remote attacker to inject arbitrary headers.
Affected Software
7 affected components
Fortinet FortiWeb>=6.3.6<=6.3.21
Fortinet FortiWeb=6.4.0
Fortinet FortiWeb=6.4.1
Fortinet FortiWeb=6.4.2
Fortinet FortiWeb=7.0.0
Fortinet FortiWeb=7.0.1
Fortinet FortiWeb=7.0.2
Remediation
Patch Available
Information
Please upgrade to FortiWeb version 7.2.0 or above Please upgrade to FortiWeb version 7.0.3 or above
Event History
Jan 3, 2023
CVE Published
via MITRE·04:58 PM
Data Sourced
via MITRE·04:58 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2022-42471.
2
What is the severity of CVE-2022-42471?
The severity of CVE-2022-42471 is medium with a CVSS score of 5.4.
3
What is the CWE ID for CVE-2022-42471?
The CWE ID for CVE-2022-42471 is CWE-74.
4
Which versions of FortiWeb are affected by CVE-2022-42471?
FortiWeb version 6.3.6 through 6.3.20, version 6.4.0 through 6.4.2, and version 7.0.0 through 7.0.2 are affected by CVE-2022-42471.
5
How can an attacker exploit CVE-2022-42471?
An authenticated and remote attacker may inject arbitrary HTTP headers in FortiWeb versions 6.3.6 through 6.3.20, 6.4.0 through 6.4.2, and 7.0.0 through 7.0.2.