CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
47.6%
An improper neutralization of CRLF sequences in HTTP headers (βHTTP Response Splittingβ) vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.4.0 through 6.4.2, FortiWeb version 6.3.6 through 6.3.20 may allow an authenticated and remote attackerΒ to inject arbitrary headers.
Vendor | Product | Version | CPE |
---|---|---|---|
fortinet | fortiweb | * | cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* |
fortinet | fortiweb | 6.4.0 | cpe:2.3:a:fortinet:fortiweb:6.4.0:*:*:*:*:*:*:* |
fortinet | fortiweb | 6.4.1 | cpe:2.3:a:fortinet:fortiweb:6.4.1:*:*:*:*:*:*:* |
fortinet | fortiweb | 6.4.2 | cpe:2.3:a:fortinet:fortiweb:6.4.2:*:*:*:*:*:*:* |
fortinet | fortiweb | 7.0.0 | cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:* |
fortinet | fortiweb | 7.0.1 | cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:* |
fortinet | fortiweb | 7.0.2 | cpe:2.3:a:fortinet:fortiweb:7.0.2:*:*:*:*:*:*:* |
[
{
"vendor": "Fortinet",
"product": "FortiWeb",
"defaultStatus": "unaffected",
"versions": [
{
"versionType": "semver",
"version": "7.0.0",
"lessThanOrEqual": "7.0.2",
"status": "affected"
},
{
"versionType": "semver",
"version": "6.4.0",
"lessThanOrEqual": "6.4.2",
"status": "affected"
},
{
"versionType": "semver",
"version": "6.3.6",
"lessThanOrEqual": "6.3.21",
"status": "affected"
}
]
}
]
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
47.6%