CVE-2025-54972

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-54972
An improper neutralization of crlf sequences ('crlf injection') in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2 all versions, FortiMail 7.0 all versions may allow an attacker to inject headers in the response via convincing a user to click on a specifically crafted link

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://fortiguard.fortinet.com/psirt/FG-IR-25-634 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*
History

20 Nov 2025, 14:31

Type Values Removed Values Added
References () https://fortiguard.fortinet.com/psirt/FG-IR-25-634 - () https://fortiguard.fortinet.com/psirt/FG-IR-25-634 - Vendor Advisory
First Time Fortinet
Fortinet fortimail
CPE cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*

18 Nov 2025, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-11-18 17:16

Updated : 2025-11-20 14:31

NVD link : CVE-2025-54972

Mitre link : CVE-2025-54972

CVE.ORG link : CVE-2025-54972

JSON object : View

Products Affected

fortinet

  • fortimail
CWE
CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')