Riskcovery

CVE-2022-23439

State
Published
Severity
4.1 Medium
Published
Jan 22, 2025
Updated
Jan 14, 2026
Reserved
Jan 19, 2022

Read the record on cve.org

Description

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

Scores

CVSSScoreVectorSource
3.14.1 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:Cfortinet

Weaknesses

Affected Products

ProductVersions
FortiTesterFortinet
  • 7.2.0 through 7.2.1Affected
  • 7.1.0 through 7.1.1Affected
  • 7.0.0Affected
  • 4.2.0 through 4.2.1Affected
  • 4.1.0 through 4.1.1Affected
  • 4.0.0Affected
  • 3.9.0 through 3.9.2Affected
  • 3.8.0Affected
  • 3.7.0 through 3.7.1Affected
  • 3.6.0Affected
  • 3.5.0 through 3.5.1Affected
  • 3.4.0Affected
  • 3.3.0 through 3.3.1Affected
FortiOSFortinet
  • 7.2.0Affected
  • 7.0.0 through 7.0.5Affected
  • 6.4.0 through 6.4.16Affected
  • 6.2.0 through 6.2.17Affected
  • 6.0.0 through 6.0.18Affected
  • 6.4.0 to before 6.4.*Affected
FortiRecorderFortinet
  • 6.4.0 through 6.4.2Affected
  • 6.0.0 through 6.0.10Affected
  • 2.7.0 through 2.7.7Affected
  • 2.6.0 through 2.6.3Affected
FortiNDRFortinet
  • 7.2.0Affected
  • 7.1.0Affected
  • 7.0.0 through 7.0.7Affected
  • 1.5.0 through 1.5.3Affected
  • 1.4.0Affected
  • 1.3.0 through 1.3.1Affected
  • 1.2.0Affected
  • 1.1.0Affected
FortiADCFortinet
  • 7.0.0 through 7.0.1Affected
  • 6.2.0 through 6.2.3Affected
  • 6.1.0 through 6.1.6Affected
  • 6.0.0 through 6.0.4Affected
  • 5.4.0 through 5.4.5Affected
  • 5.3.0 through 5.3.7Affected
  • 5.2.0 through 5.2.8Affected
  • 5.1.0 through 5.1.7Affected
  • 5.0.0 through 5.0.4Affected
FortiManagerFortinet
  • 7.4.0 through 7.4.3Affected
  • 7.2.0 through 7.2.11Affected
  • 7.0.0 through 7.0.15Affected
  • 6.4.0 through 6.4.15Affected
  • 6.2.0 through 6.2.13Affected
FortiVoiceFortinet
  • 7.0.0 through 7.0.1Affected
  • 6.4.0 through 6.4.8Affected
  • 6.0.0 through 6.0.11Affected
FortiSOAR on-premiseFortinet
  • 7.2.0 through 7.2.2Affected
  • 7.0.0 through 7.0.3Affected
  • 6.4.3 through 6.4.4Affected
  • 6.4.0 through 6.4.1Affected
FortiDDoSFortinet
  • 5.5.0 through 5.5.1Affected
  • 5.4.0 through 5.4.3Affected
  • 5.3.0 through 5.3.2Affected
  • 5.2.0Affected
  • 5.1.0Affected
  • 5.0.0Affected
  • 4.7.0Affected
  • 4.6.0Affected
  • 4.5.0Affected
FortiWLCFortinet
  • 8.6.0 through 8.6.7Affected
  • 8.5.0 through 8.5.5Affected
  • 8.4.4 through 8.4.8Affected
  • 8.4.0 through 8.4.2Affected
FortiAnalyzerFortinet
  • 7.4.0 through 7.4.2Affected
  • 7.2.0 through 7.2.11Affected
  • 7.0.0 through 7.0.15Affected
  • 6.4.0 through 6.4.15Affected
  • 6.2.0 through 6.2.13Affected
FortiPortalFortinet
  • 6.0.0 through 6.0.9Affected
FortiAuthenticatorFortinet
  • 6.4.0 through 6.4.1Affected
  • 6.3.0 through 6.3.3Affected
  • 6.2.0 through 6.2.2Affected
  • 6.1.0 through 6.1.3Affected
  • 6.0.0 through 6.0.8Affected
  • 5.5.0Affected
  • 5.4.0 through 5.4.1Affected
  • 5.3.0 through 5.3.1Affected
  • 5.2.0 through 5.2.2Affected
  • 5.1.0 through 5.1.2Affected
FortiMailFortinet
  • 7.0.0 through 7.0.3Affected
  • 6.4.0 through 6.4.8Affected
  • 6.2.0 through 6.2.9Affected
  • 6.0.0 through 6.0.12Affected
  • 5.4.0 through 5.4.12Affected
FortiDDoS-FFortinet
  • 6.3.0 through 6.3.3Affected
  • 6.2.0 through 6.2.3Affected
  • 6.1.0 through 6.1.5Affected
FortiSwitchFortinet
  • 7.0.0 through 7.0.4Affected
  • 6.4.0 through 6.4.10Affected
  • 6.2.0 through 6.2.8Affected
  • 6.0.0 through 6.0.7Affected
FortiProxyFortinet
  • 7.0.0 through 7.0.4Affected
  • 2.0.0 through 2.0.14Affected
  • 1.2.0 through 1.2.13Affected
  • 1.1.0 through 1.1.6Affected
  • 1.0.0 through 1.0.7Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.