Vulnerability · Published Jan 22, 2025 · Assigned by fortinet
CVE-2022-23439
Medium 4.1
In plain English
A medium-severity security flaw in FortiADC from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)0.5%top 59.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiTester | 7.2.0 – through 7.2.17.1.0 – through 7.1.17.0.04.2.0 – through 4.2.14.1.0 – through 4.1.14.0.03.9.0 – through 3.9.23.8.0 |
| Fortinet | FortiOS | 7.2.07.0.0 – through 7.0.56.4.0 – through 6.4.166.2.0 – through 6.2.176.0.0 – through 6.0.186.4.0 – before 6.4.* |
| Fortinet | FortiRecorder | 6.4.0 – through 6.4.26.0.0 – through 6.0.102.7.0 – through 2.7.72.6.0 – through 2.6.3 |
| Fortinet | FortiNDR | 7.2.07.1.07.0.0 – through 7.0.71.5.0 – through 1.5.31.4.01.3.0 – through 1.3.11.2.01.1.0 |
| Fortinet | FortiADC | 7.0.0 – through 7.0.16.2.0 – through 6.2.36.1.0 – through 6.1.66.0.0 – through 6.0.45.4.0 – through 5.4.55.3.0 – through 5.3.75.2.0 – through 5.2.85.1.0 – through 5.1.7 |
| Fortinet | FortiManager | 7.4.0 – through 7.4.37.2.0 – through 7.2.117.0.0 – through 7.0.156.4.0 – through 6.4.156.2.0 – through 6.2.13 |
| Fortinet | FortiVoice | 7.0.0 – through 7.0.16.4.0 – through 6.4.86.0.0 – through 6.0.11 |
| Fortinet | FortiSOAR on-premise | 7.2.0 – through 7.2.27.0.0 – through 7.0.36.4.3 – through 6.4.46.4.0 – through 6.4.1 |
| Fortinet | FortiDDoS | 5.5.0 – through 5.5.15.4.0 – through 5.4.35.3.0 – through 5.3.25.2.05.1.05.0.04.7.04.6.0 |
| Fortinet | FortiWLC | 8.6.0 – through 8.6.78.5.0 – through 8.5.58.4.4 – through 8.4.88.4.0 – through 8.4.2 |
| Fortinet | FortiAnalyzer | 7.4.0 – through 7.4.27.2.0 – through 7.2.117.0.0 – through 7.0.156.4.0 – through 6.4.156.2.0 – through 6.2.13 |
| Fortinet | FortiPortal | 6.0.0 – through 6.0.9 |
| Fortinet | FortiAuthenticator | 6.4.0 – through 6.4.16.3.0 – through 6.3.36.2.0 – through 6.2.26.1.0 – through 6.1.36.0.0 – through 6.0.85.5.05.4.0 – through 5.4.15.3.0 – through 5.3.1 |
| Fortinet | FortiMail | 7.0.0 – through 7.0.36.4.0 – through 6.4.86.2.0 – through 6.2.96.0.0 – through 6.0.125.4.0 – through 5.4.12 |
| Fortinet | FortiDDoS-F | 6.3.0 – through 6.3.36.2.0 – through 6.2.36.1.0 – through 6.1.5 |
| Fortinet | FortiSwitch | 7.0.0 – through 7.0.46.4.0 – through 6.4.106.2.0 – through 6.2.86.0.0 – through 6.0.7 |
| Fortinet | FortiProxy | 7.0.0 – through 7.0.42.0.0 – through 2.0.141.2.0 – through 1.2.131.1.0 – through 1.1.61.0.0 – through 1.0.7 |
Weakness: CWE-610 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C