Skip to content
CVE PROGRAM SOURCE RECORD4.1 Medium

CVE-2022-23439

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiTester

Default version status: unaffected

  • 7.2.0 to ≤ 7.2.1affected
  • 7.1.0 to ≤ 7.1.1affected
  • 7.0.0affected
  • 4.2.0 to ≤ 4.2.1affected
  • 4.1.0 to ≤ 4.1.1affected
  • 4.0.0affected
  • 3.9.0 to ≤ 3.9.2affected
  • 3.8.0affected
  • 3.7.0 to ≤ 3.7.1affected
  • 3.6.0affected
  • 3.5.0 to ≤ 3.5.1affected
  • 3.4.0affected
  • 3.3.0 to ≤ 3.3.1affected

Fortinet FortiOS

Default version status: unaffected

  • 7.2.0affected
  • 7.0.0 to ≤ 7.0.5affected
  • 6.4.0 to ≤ 6.4.16affected
  • 6.2.0 to ≤ 6.2.17affected
  • 6.0.0 to ≤ 6.0.18affected
  • 6.4.0 to < 6.4.*affected

Fortinet FortiRecorder

Default version status: unaffected

  • 6.4.0 to ≤ 6.4.2affected
  • 6.0.0 to ≤ 6.0.10affected
  • 2.7.0 to ≤ 2.7.7affected
  • 2.6.0 to ≤ 2.6.3affected

Fortinet FortiNDR

Default version status: unaffected

  • 7.2.0affected
  • 7.1.0affected
  • 7.0.0 to ≤ 7.0.7affected
  • 1.5.0 to ≤ 1.5.3affected
  • 1.4.0affected
  • 1.3.0 to ≤ 1.3.1affected
  • 1.2.0affected
  • 1.1.0affected

Fortinet FortiADC

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.1affected
  • 6.2.0 to ≤ 6.2.3affected
  • 6.1.0 to ≤ 6.1.6affected
  • 6.0.0 to ≤ 6.0.4affected
  • 5.4.0 to ≤ 5.4.5affected
  • 5.3.0 to ≤ 5.3.7affected
  • 5.2.0 to ≤ 5.2.8affected
  • 5.1.0 to ≤ 5.1.7affected
  • 5.0.0 to ≤ 5.0.4affected

Fortinet FortiManager

Default version status: unaffected

  • 7.4.0 to ≤ 7.4.3affected
  • 7.2.0 to ≤ 7.2.11affected
  • 7.0.0 to ≤ 7.0.15affected
  • 6.4.0 to ≤ 6.4.15affected
  • 6.2.0 to ≤ 6.2.13affected

Fortinet FortiVoice

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.1affected
  • 6.4.0 to ≤ 6.4.8affected
  • 6.0.0 to ≤ 6.0.11affected

Fortinet FortiSOAR on-premise

Default version status: unaffected

  • 7.2.0 to ≤ 7.2.2affected
  • 7.0.0 to ≤ 7.0.3affected
  • 6.4.3 to ≤ 6.4.4affected
  • 6.4.0 to ≤ 6.4.1affected

Fortinet FortiDDoS

Default version status: unaffected

  • 5.5.0 to ≤ 5.5.1affected
  • 5.4.0 to ≤ 5.4.3affected
  • 5.3.0 to ≤ 5.3.2affected
  • 5.2.0affected
  • 5.1.0affected
  • 5.0.0affected
  • 4.7.0affected
  • 4.6.0affected
  • 4.5.0affected

Fortinet FortiWLC

Default version status: unaffected

  • 8.6.0 to ≤ 8.6.7affected
  • 8.5.0 to ≤ 8.5.5affected
  • 8.4.4 to ≤ 8.4.8affected
  • 8.4.0 to ≤ 8.4.2affected

Fortinet FortiAnalyzer

Default version status: unaffected

  • 7.4.0 to ≤ 7.4.2affected
  • 7.2.0 to ≤ 7.2.11affected
  • 7.0.0 to ≤ 7.0.15affected
  • 6.4.0 to ≤ 6.4.15affected
  • 6.2.0 to ≤ 6.2.13affected

Fortinet FortiPortal

Default version status: unaffected

  • 6.0.0 to ≤ 6.0.9affected

Fortinet FortiAuthenticator

Default version status: unaffected

  • 6.4.0 to ≤ 6.4.1affected
  • 6.3.0 to ≤ 6.3.3affected
  • 6.2.0 to ≤ 6.2.2affected
  • 6.1.0 to ≤ 6.1.3affected
  • 6.0.0 to ≤ 6.0.8affected
  • 5.5.0affected
  • 5.4.0 to ≤ 5.4.1affected
  • 5.3.0 to ≤ 5.3.1affected
  • 5.2.0 to ≤ 5.2.2affected
  • 5.1.0 to ≤ 5.1.2affected

Fortinet FortiMail

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.3affected
  • 6.4.0 to ≤ 6.4.8affected
  • 6.2.0 to ≤ 6.2.9affected
  • 6.0.0 to ≤ 6.0.12affected
  • 5.4.0 to ≤ 5.4.12affected

Fortinet FortiDDoS-F

Default version status: unaffected

  • 6.3.0 to ≤ 6.3.3affected
  • 6.2.0 to ≤ 6.2.3affected
  • 6.1.0 to ≤ 6.1.5affected

Fortinet FortiSwitch

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.4affected
  • 6.4.0 to ≤ 6.4.10affected
  • 6.2.0 to ≤ 6.2.8affected
  • 6.0.0 to ≤ 6.0.7affected

Fortinet FortiProxy

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.4affected
  • 2.0.0 to ≤ 2.0.14affected
  • 1.2.0 to ≤ 1.2.13affected
  • 1.1.0 to ≤ 1.1.6affected
  • 1.0.0 to ≤ 1.0.7affected

References