CVE-2022-42472: fortiproxy 7.2.0, 7.2.1; +3 more affected products

Affected technology

fortiproxy · from 1.1.0 (inclusive), through 1.1.6 (inclusive)
fortinet

fortiproxy · from 1.2.0 (inclusive), through 1.2.13 (inclusive)
fortinet

fortiproxy · from 2.0.0 (inclusive), through 2.0.10 (inclusive)
fortinet

fortiproxy · from 7.0.0 (inclusive), through 7.0.7 (inclusive)
fortinet

fortiproxy · 7.2.0
fortinet

fortiproxy · 7.2.1
fortinet

fortios · from 6.0.1 (inclusive), through 6.0.16 (inclusive)
fortinet

fortios · from 6.2.0 (inclusive), through 6.2.12 (inclusive)
fortinet

fortios · from 6.4.0 (inclusive), through 6.4.11 (inclusive)
fortinet

fortios · from 7.0.0 (inclusive), through 7.0.8 (inclusive)
fortinet

fortios · 7.2.0
fortinet

fortios · 7.2.1
fortinet

fortios · 7.2.2
fortinet

FortiProxy · 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.1 through 1.2.13, 01.02.00, 1.1.4 through 1.1.6, 01.01.00 through 01.01.03
Fortinet

FortiOS · 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.12, 6.2.0 through 6.2.17, 6.0.0 through 6.0.18
Fortinet

Description’s affected range: through 7.2.2

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated and remote attacker may perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response. Vendor/CNA’s CVSS 3.1 assessment (base score 4.2/10) rates confidentiality and integrity impact as low; availability impact as none. NVD’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.