CVE-2022-23439

Published: Jan 22, 2025Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

Affected (19)

Products: Fortinet: Fortiadc, Fortiauthenticator, Fortiddos, Fortiddos F, Fortimail, Fortindr, Fortios, Fortiproxy, Fortirecorder, Fortisoar, Fortiswitch, Fortitester, Fortivoice, Fortiwlc

14 products

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiadc	From 5.4.0 to 6.2.4
Fortinet Fortiauthenticator	From 6.3.0 to 6.3.4
Fortinet Fortiauthenticator	From 6.4.0 to 6.4.2
Fortinet Fortiddos	From 5.3.0 to 5.5.2
Fortinet Fortiddos F	From 6.1.0 to 6.3.4
Fortinet Fortimail	From 6.4.0 to 7.0.4
Fortinet Fortindr	From 1.4.0 to 7.1.1
Fortinet Fortindr	Version 7.2.0
Fortinet Fortios	From 6.0.0 to 7.0.6
Fortinet Fortios	From 7.2.0 to 7.2.5
Fortinet Fortiproxy	From 2.0.0 to 7.0.5
Fortinet Fortiproxy	From 7.2.0 to 7.4.0
Fortinet Fortirecorder	From 6.0.0 to 6.0.11
Fortinet Fortirecorder	From 6.4.0 to 6.4.3
Fortinet Fortisoar	From 6.4.0 to 7.3.0
Fortinet Fortiswitch	From 6.4.0 to 7.0.5
Fortinet Fortitester	From 3.7.0 to 7.2.2
Fortinet Fortivoice	From 6.0.0 to 6.4.9
Fortinet Fortiwlc	From 8.6.0 to 8.6.7

Related CWEs

CWE-610

Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

References (1)

https://fortiguard.com/psirt/FG-IR-23-494

Source: psirt@fortinet.com

Timeline

No history available yet.