CVE-2022-23439

Published: Jan 22, 2025

Modified: Jan 14, 2026

PUBLISHED

CVSS v3.1

4.1

MEDIUM

Description

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

Vendor	Product	Versions
Fortinet	FortiTester	affected `7.2.0 - <= 7.2.1` affected `7.1.0 - <= 7.1.1` affected `7.0.0` affected `4.2.0 - <= 4.2.1` affected `4.1.0 - <= 4.1.1` +8 more versions
Fortinet	FortiOS	affected `7.2.0` affected `7.0.0 - <= 7.0.5` affected `6.4.0 - <= 6.4.16` affected `6.2.0 - <= 6.2.17` affected `6.0.0 - <= 6.0.18` +1 more versions
Fortinet	FortiRecorder	affected `6.4.0 - <= 6.4.2` affected `6.0.0 - <= 6.0.10` affected `2.7.0 - <= 2.7.7` affected `2.6.0 - <= 2.6.3`
Fortinet	FortiNDR	affected `7.2.0` affected `7.1.0` affected `7.0.0 - <= 7.0.7` affected `1.5.0 - <= 1.5.3` affected `1.4.0` +3 more versions
Fortinet	FortiADC	affected `7.0.0 - <= 7.0.1` affected `6.2.0 - <= 6.2.3` affected `6.1.0 - <= 6.1.6` affected `6.0.0 - <= 6.0.4` affected `5.4.0 - <= 5.4.5` +4 more versions
Fortinet	FortiManager	affected `7.4.0 - <= 7.4.3` affected `7.2.0 - <= 7.2.11` affected `7.0.0 - <= 7.0.15` affected `6.4.0 - <= 6.4.15` affected `6.2.0 - <= 6.2.13`
Fortinet	FortiVoice	affected `7.0.0 - <= 7.0.1` affected `6.4.0 - <= 6.4.8` affected `6.0.0 - <= 6.0.11`
Fortinet	FortiSOAR on-premise	affected `7.2.0 - <= 7.2.2` affected `7.0.0 - <= 7.0.3` affected `6.4.3 - <= 6.4.4` affected `6.4.0 - <= 6.4.1`
Fortinet	FortiDDoS	affected `5.5.0 - <= 5.5.1` affected `5.4.0 - <= 5.4.3` affected `5.3.0 - <= 5.3.2` affected `5.2.0` affected `5.1.0` +4 more versions
Fortinet	FortiWLC	affected `8.6.0 - <= 8.6.7` affected `8.5.0 - <= 8.5.5` affected `8.4.4 - <= 8.4.8` affected `8.4.0 - <= 8.4.2`
Fortinet	FortiAnalyzer	affected `7.4.0 - <= 7.4.2` affected `7.2.0 - <= 7.2.11` affected `7.0.0 - <= 7.0.15` affected `6.4.0 - <= 6.4.15` affected `6.2.0 - <= 6.2.13`
Fortinet	FortiPortal	affected `6.0.0 - <= 6.0.9`
Fortinet	FortiAuthenticator	affected `6.4.0 - <= 6.4.1` affected `6.3.0 - <= 6.3.3` affected `6.2.0 - <= 6.2.2` affected `6.1.0 - <= 6.1.3` affected `6.0.0 - <= 6.0.8` +5 more versions
Fortinet	FortiMail	affected `7.0.0 - <= 7.0.3` affected `6.4.0 - <= 6.4.8` affected `6.2.0 - <= 6.2.9` affected `6.0.0 - <= 6.0.12` affected `5.4.0 - <= 5.4.12`
Fortinet	FortiDDoS-F	affected `6.3.0 - <= 6.3.3` affected `6.2.0 - <= 6.2.3` affected `6.1.0 - <= 6.1.5`
Fortinet	FortiSwitch	affected `7.0.0 - <= 7.0.4` affected `6.4.0 - <= 6.4.10` affected `6.2.0 - <= 6.2.8` affected `6.0.0 - <= 6.0.7`
Fortinet	FortiProxy	affected `7.0.0 - <= 7.0.4` affected `2.0.0 - <= 2.0.14` affected `1.2.0 - <= 1.2.13` affected `1.1.0 - <= 1.1.6` affected `1.0.0 - <= 1.0.7`

Weaknesses (CWE)

CWE-610

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

References

https://fortiguard.com/psirt/FG-IR-23-494

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2022-23439

Description

Affected Products

Weaknesses (CWE)

CVSS v3.1 Details

References