← Back

CVE-2025-62675

nvd nist
Published: Jul 14, 2026Modified: Jul 14, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicking on a crafted link.

Affected (2)

Fortinet
2 products
Fortios
Fortiproxy
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortios
From 7.2.0 to 7.6.5
Fortiproxy
From 7.2.0 to 7.6.5

Related CWEs

CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.