CVE-2022-42471

5.4 mediumEPSS 0.5%

An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.4.0 through 6.4.2, FortiWeb version 6.3.6 through 6.3.20 may allow an authenticated and remote attacker to inject arbitrary headers.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-113
Published: 2023-01-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortiweb

References

https://fortiguard.com/psirt/FG-IR-22-250
https://fortiguard.com/psirt/FG-IR-22-250

Check your stack JSON