4.3
Medium
CVE-2021-32598 An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager…
Description
An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUI 7.0.0, 6.4.6 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fortinet FortiAnalyzer, FortiManager | Versions not published |
Other CVEs of Fortinet FortiAnalyzer, FortiManager
The 6 CVEs of Fortinet FortiAnalyzer, FortiManager →
CVE-2022-39950
An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and…
8.0
High
CVE-2021-32587
An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8…
4.3
Medium
CVE-2021-32597
Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions…
4.6
Medium
CVE-2021-32603
A server-side request forgery (SSRF) (CWE-918) vulnerability in FortiManager and FortiAnalyser GUI 7.0.0, 6.4.5 and…
8.8
High