CVE-2021-32598

Name of the Vulnerable Software and Affected Versions FortiManager and FortiAnalyzer GUI versions 7.0.0, 6.4.6 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below

Description The issue is related to an improper neutralization of CRLF sequences in HTTP headers, also known as 'HTTP Response Splitting'. This may allow an authenticated and remote attacker to perform an HTTP request splitting attack, giving them control of the remaining headers and body of the response. The attacker can exploit this vulnerability to inject arbitrary HTTP headers.

Recommendations For FortiManager and FortiAnalyzer GUI versions 7.0.0, 6.4.6 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below: At the moment, there is no information about a newer version that contains a fix for this vulnerability.