CVE-2022-42472: Medium severity fortinet fortiproxy ssl vpn webmode vulnerability
A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response.
Affected Software
Remediation
Patch Available
Information
Event History
Frequently Asked Questions
What is the vulnerability CVE-2022-42472?
The vulnerability CVE-2022-42472 is an improper neutralization of CRLF sequences in HTTP headers, also known as HTTP response splitting, in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10.
How severe is the vulnerability CVE-2022-42472?
The vulnerability CVE-2022-42472 has a severity rating of 5.4 (medium).
Which software versions are affected by CVE-2022-42472?
The software versions affected by CVE-2022-42472 are Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, and FortiProxy versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10.
How can I fix the vulnerability CVE-2022-42472?
To fix the vulnerability CVE-2022-42472, it is recommended to update to the latest patched version of Fortinet FortiOS or FortiProxy.
Where can I find more information about CVE-2022-42472?
You can find more information about CVE-2022-42472 on the Fortiguard website at: [https://fortiguard.com/psirt/FG-IR-22-362](https://fortiguard.com/psirt/FG-IR-22-362)