An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicking on a crafted link.
Una vulnerabilidad de neutralización incorrecta de secuencias CRLF en encabezados HTTP ('División de respuesta HTTP') [CWE-113] vulnerabilidad en Fortinet FortiOS 7.6.0 hasta 7.6.4, FortiOS 7.4 todas las versiones, FortiOS 7.2 todas las versiones, FortiProxy 7.6.0 hasta 7.6.4, FortiProxy 7.4 todas las versiones, FortiProxy 7.2 todas las versiones puede permitir a un atacante en posesión de un token de anulación de filtro web válido inyectar encabezados arbitrarios mediante el engaño a un usuario para que haga clic en un enlace manipulado.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | LOW |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-113
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| fortinet | fortiproxy | * | <built-in method update of dict object at 0x7fd39c478440> | Application |
| fortinet | fortios | * | <built-in method update of dict object at 0x7fd385056480> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* |