An improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS 7.2.0 through 7.6.0, FortiProxy 7.2.0 through 7.4.5 allows attacker to execute unauthorized code or commands via crafted HTTP header.
2025-01-14T14:15:34.287
2025-02-03T22:04:26.590
Analyzed
CVSSv3.1: 6.5 (MEDIUM)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | fortinet | fortiproxy | < 7.2.12 | Yes |
| Application | fortinet | fortiproxy | < 7.4.6 | Yes |
| Operating System | fortinet | fortios | < 7.2.9 | Yes |
| Operating System | fortinet | fortios | < 7.4.5 | Yes |
| Operating System | fortinet | fortios | 7.6.0 | Yes |