HTTP Response Splitting Vulnerability in Fortinet FortiOS and FortiProxy
CVE-2024-54021
9.8CRITICAL
What is CVE-2024-54021?
An improper neutralization of CRLF sequences in HTTP headers has been identified in Fortinet FortiOS versions 7.2.0 through 7.6.0 and FortiProxy versions 7.2.0 through 7.4.5. This vulnerability enables attackers to craft malicious HTTP headers, which could lead to unauthorized code execution or command execution on vulnerable systems. Fortinet users are advised to apply security patches to mitigate potential risks associated with this flaw.
Affected Version(s)
FortiOS 7.6.0
FortiOS 7.4.0 <= 7.4.4
FortiOS 7.2.0 <= 7.2.8