ID
VAR-202302-1300
CVE
CVE-2022-42472
TITLE
fortinet's FortiProxy and FortiOS Injection vulnerability in
Trust: 0.8
DESCRIPTION
A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response. fortinet's FortiProxy and FortiOS There is an injection vulnerability in.Information may be obtained and information may be tampered with
Trust: 1.8
AFFECTED PRODUCTS
| vendor: | fortinet | model: | fortiproxy | scope: | gte | version: | 7.0.0 | Trust: 1.0 |
| vendor: | fortinet | model: | fortiproxy | scope: | lte | version: | 1.1.6 | Trust: 1.0 |
| vendor: | fortinet | model: | fortios | scope: | eq | version: | 7.2.1 | Trust: 1.0 |
| vendor: | fortinet | model: | fortiproxy | scope: | eq | version: | 7.2.1 | Trust: 1.0 |
| vendor: | fortinet | model: | fortiproxy | scope: | gte | version: | 1.1.0 | Trust: 1.0 |
| vendor: | fortinet | model: | fortios | scope: | lte | version: | 6.2.12 | Trust: 1.0 |
| vendor: | fortinet | model: | fortiproxy | scope: | lte | version: | 2.0.10 | Trust: 1.0 |
| vendor: | fortinet | model: | fortios | scope: | gte | version: | 7.0.0 | Trust: 1.0 |
| vendor: | fortinet | model: | fortios | scope: | gte | version: | 6.2.0 | Trust: 1.0 |
| vendor: | fortinet | model: | fortiproxy | scope: | lte | version: | 1.2.13 | Trust: 1.0 |
| vendor: | fortinet | model: | fortios | scope: | gte | version: | 6.0.1 | Trust: 1.0 |
| vendor: | fortinet | model: | fortios | scope: | lte | version: | 6.0.16 | Trust: 1.0 |
| vendor: | fortinet | model: | fortios | scope: | eq | version: | 7.2.0 | Trust: 1.0 |
| vendor: | fortinet | model: | fortiproxy | scope: | gte | version: | 2.0.0 | Trust: 1.0 |
| vendor: | fortinet | model: | fortiproxy | scope: | eq | version: | 7.2.0 | Trust: 1.0 |
| vendor: | fortinet | model: | fortios | scope: | gte | version: | 6.4.0 | Trust: 1.0 |
| vendor: | fortinet | model: | fortiproxy | scope: | gte | version: | 1.2.0 | Trust: 1.0 |
| vendor: | fortinet | model: | fortiproxy | scope: | lte | version: | 7.0.7 | Trust: 1.0 |
| vendor: | fortinet | model: | fortios | scope: | eq | version: | 7.2.2 | Trust: 1.0 |
| vendor: | fortinet | model: | fortios | scope: | lte | version: | 7.0.8 | Trust: 1.0 |
| vendor: | fortinet | model: | fortios | scope: | lte | version: | 6.4.11 | Trust: 1.0 |
| vendor: | フォーティネット | model: | fortios | scope: | eq | version: | 6.4.0 to 6.4.11 | Trust: 0.8 |
| vendor: | フォーティネット | model: | fortios | scope: | eq | version: | 7.2.0 | Trust: 0.8 |
| vendor: | フォーティネット | model: | fortios | scope: | eq | version: | 7.2.2 | Trust: 0.8 |
| vendor: | フォーティネット | model: | fortiproxy | scope: | - | version: | - | Trust: 0.8 |
| vendor: | フォーティネット | model: | fortios | scope: | eq | version: | 7.0.0 to 7.0.8 | Trust: 0.8 |
| vendor: | フォーティネット | model: | fortios | scope: | eq | version: | 6.2.0 to 6.2.12 | Trust: 0.8 |
| vendor: | フォーティネット | model: | fortios | scope: | eq | version: | 7.2.1 | Trust: 0.8 |
| vendor: | フォーティネット | model: | fortios | scope: | eq | version: | 6.0.1 to 6.0.16 | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-113 | Trust: 1.0 |
| problemtype: | CWE-74 | Trust: 1.0 |
| problemtype: | injection (CWE-74) [NVD evaluation ] | Trust: 0.8 |
| problemtype: | CWE-436 | Trust: 0.1 |
THREAT TYPE
remote
Trust: 0.6
TYPE
other
Trust: 0.6
PATCH
| title: | FG-IR-22-362 | url: | https://www.fortiguard.com/psirt/FG-IR-22-362 | Trust: 0.8 |
| title: | Fortinet FortiOS Security vulnerabilities | url: | http://123.124.177.30/web/xxk/bdxqById.tag?id=226088 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2022-42472 | Trust: 3.4 |
| db: | JVNDB | id: | JVNDB-2022-019901 | Trust: 0.8 |
| db: | AUSCERT | id: | ESB-2023.1052 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202302-1426 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-439113 | Trust: 0.1 |
| db: | VULMON | id: | CVE-2022-42472 | Trust: 0.1 |
REFERENCES
| url: | https://fortiguard.com/psirt/fg-ir-22-362 | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2022-42472 | Trust: 0.8 |
| url: | https://www.auscert.org.au/bulletins/esb-2023.1052 | Trust: 0.6 |
| url: | https://cxsecurity.com/cveshow/cve-2022-42472/ | Trust: 0.6 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
SOURCES
| db: | VULHUB | id: | VHN-439113 |
| db: | VULMON | id: | CVE-2022-42472 |
| db: | JVNDB | id: | JVNDB-2022-019901 |
| db: | CNNVD | id: | CNNVD-202302-1426 |
| db: | NVD | id: | CVE-2022-42472 |
LAST UPDATE DATE
2024-08-14T15:05:53.755000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-439113 | date: | 2023-02-27T00:00:00 |
| db: | VULMON | id: | CVE-2022-42472 | date: | 2023-02-16T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-019901 | date: | 2023-10-30T01:20:00 |
| db: | CNNVD | id: | CNNVD-202302-1426 | date: | 2023-02-28T00:00:00 |
| db: | NVD | id: | CVE-2022-42472 | date: | 2023-11-07T03:53:22.160 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-439113 | date: | 2023-02-16T00:00:00 |
| db: | VULMON | id: | CVE-2022-42472 | date: | 2023-02-16T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-019901 | date: | 2023-10-30T00:00:00 |
| db: | CNNVD | id: | CNNVD-202302-1426 | date: | 2023-02-16T00:00:00 |
| db: | NVD | id: | CVE-2022-42472 | date: | 2023-02-16T19:15:13.583 |