CVE-2022-23439
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
22/01/2025
Last modified:
12/02/2025
Description
A externally controlled reference to a resource in another sphere in Fortinet FortiManager before version 7.4.3, FortiMail before version 7.0.3, FortiAnalyzer before version 7.4.3, FortiVoice version 7.0.0, 7.0.1 and before 6.4.8, FortiProxy before version 7.0.4, FortiRecorder version 6.4.0 through 6.4.2 and before 6.0.10, FortiAuthenticator version 6.4.0 through 6.4.1 and before 6.3.3, FortiNDR version 7.2.0 before 7.1.0, FortiWLC before version 8.6.4, FortiPortal before version 6.0.9, FortiOS version 7.2.0 and before 7.0.5, FortiADC version 7.0.0 through 7.0.1 and before 6.2.3 , FortiDDoS before version 5.5.1, FortiDDoS-F before version 6.3.3, FortiTester before version 7.2.1, FortiSOAR before version 7.2.2 and FortiSwitch before version 6.3.3 allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver
Impact
Base Score 3.x
4.70
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:* | 5.4.0 (including) | 6.2.4 (excluding) |
| cpe:2.3:a:fortinet:fortiauthenticator:*:*:*:*:*:*:*:* | 6.3.0 (including) | 6.3.4 (excluding) |
| cpe:2.3:a:fortinet:fortiauthenticator:*:*:*:*:*:*:*:* | 6.4.0 (including) | 6.4.2 (excluding) |
| cpe:2.3:a:fortinet:fortiddos:*:*:*:*:*:*:*:* | 5.3.0 (including) | 5.5.2 (excluding) |
| cpe:2.3:a:fortinet:fortiddos-f:*:*:*:*:*:*:*:* | 6.1.0 (including) | 6.3.4 (excluding) |
| cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* | 6.4.0 (including) | 7.0.4 (excluding) |
| cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:* | 1.4.0 (including) | 7.1.1 (excluding) |
| cpe:2.3:a:fortinet:fortindr:7.2.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* | 2.0.0 (including) | 7.0.5 (excluding) |
| cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* | 7.2.0 (including) | 7.4.0 (excluding) |
| cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:* | 6.0.0 (including) | 6.0.11 (excluding) |
| cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:* | 6.4.0 (including) | 6.4.3 (excluding) |
| cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:* | 6.4.0 (including) | 7.3.0 (excluding) |
| cpe:2.3:a:fortinet:fortitester:*:*:*:*:*:*:*:* | 3.7.0 (including) | 7.2.2 (excluding) |
| cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:* | 6.0.0 (including) | 6.4.9 (excluding) |
To consult the complete list of CPE names with products and versions, see this page