CVE-2022-42471

—

CVSS 3.1

5.4 medium

EPSS

<1%p39

Published

Jan 3, 2023 (Jan 3, 2023)

Modified

Jun 17, 2026

Description

An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.4.0 through 6.4.2, FortiWeb version 6.3.6 through 6.3.20 may allow an authenticated and remote attacker to inject arbitrary headers.

Vendors: fortinet
Products: fortiweb
Weakness: CWE-113, CWE-74
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.