A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Fortinet Fortiproxy | — | Upgrade to the latest version of FortiProxyUpgrade FortiProxy to 7.2.2Upgrade FortiProxy to 2.0.11Upgrade FortiProxy to 7.0.8 | Sep 30, 2026 | Feb 16, 2023 |
| Fortios | — | Upgrade FortiOS to 7.2.3Upgrade FortiOS to 6.4.13Upgrade FortiOS to 7.0.9Upgrade to the latest version of FortiOS | Mar 1, 2023 | Feb 16, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub