Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2022-23439

En bref

Sévérité
MEDIUM 4.1
EPSS
EPSS 0.45 % · centile 39 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
fortinet
Statut NVD
Modified

Description

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 4.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:Cfortinet
CVSS 3.1MEDIUM 4.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NNVD · psirt@fortinet.com (Secondary)
CVSS 3.1MEDIUM 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Fortinet · FortiTesteraffected 7.2.0 ≤ 7.2.1 ; affected 7.1.0 ≤ 7.1.1 ; affected 7.0.0 ; affected 4.2.0 ≤ 4.2.1 ; affected 4.1.0 ≤ 4.1.1 ; affected 4.0.0
Fortinet · FortiOSaffected 7.2.0 ; affected 7.0.0 ≤ 7.0.5 ; affected 6.4.0 ≤ 6.4.16 ; affected 6.2.0 ≤ 6.2.17 ; affected 6.0.0 ≤ 6.0.18 ; affected 6.4.0 < 6.4.*
Fortinet · FortiRecorderaffected 6.4.0 ≤ 6.4.2 ; affected 6.0.0 ≤ 6.0.10 ; affected 2.7.0 ≤ 2.7.7 ; affected 2.6.0 ≤ 2.6.3
Fortinet · FortiNDRaffected 7.2.0 ; affected 7.1.0 ; affected 7.0.0 ≤ 7.0.7 ; affected 1.5.0 ≤ 1.5.3 ; affected 1.4.0 ; affected 1.3.0 ≤ 1.3.1
Fortinet · FortiADCaffected 7.0.0 ≤ 7.0.1 ; affected 6.2.0 ≤ 6.2.3 ; affected 6.1.0 ≤ 6.1.6 ; affected 6.0.0 ≤ 6.0.4 ; affected 5.4.0 ≤ 5.4.5 ; affected 5.3.0 ≤ 5.3.7
Fortinet · FortiManageraffected 7.4.0 ≤ 7.4.3 ; affected 7.2.0 ≤ 7.2.11 ; affected 7.0.0 ≤ 7.0.15 ; affected 6.4.0 ≤ 6.4.15 ; affected 6.2.0 ≤ 6.2.13
Fortinet · FortiVoiceaffected 7.0.0 ≤ 7.0.1 ; affected 6.4.0 ≤ 6.4.8 ; affected 6.0.0 ≤ 6.0.11
Fortinet · FortiSOAR on-premiseaffected 7.2.0 ≤ 7.2.2 ; affected 7.0.0 ≤ 7.0.3 ; affected 6.4.3 ≤ 6.4.4 ; affected 6.4.0 ≤ 6.4.1
Fortinet · FortiDDoSaffected 5.5.0 ≤ 5.5.1 ; affected 5.4.0 ≤ 5.4.3 ; affected 5.3.0 ≤ 5.3.2 ; affected 5.2.0 ; affected 5.1.0 ; affected 5.0.0
Fortinet · FortiWLCaffected 8.6.0 ≤ 8.6.7 ; affected 8.5.0 ≤ 8.5.5 ; affected 8.4.4 ≤ 8.4.8 ; affected 8.4.0 ≤ 8.4.2
Fortinet · FortiAnalyzeraffected 7.4.0 ≤ 7.4.2 ; affected 7.2.0 ≤ 7.2.11 ; affected 7.0.0 ≤ 7.0.15 ; affected 6.4.0 ≤ 6.4.15 ; affected 6.2.0 ≤ 6.2.13
Fortinet · FortiPortalaffected 6.0.0 ≤ 6.0.9
Fortinet · FortiAuthenticatoraffected 6.4.0 ≤ 6.4.1 ; affected 6.3.0 ≤ 6.3.3 ; affected 6.2.0 ≤ 6.2.2 ; affected 6.1.0 ≤ 6.1.3 ; affected 6.0.0 ≤ 6.0.8 ; affected 5.5.0
Fortinet · FortiMailaffected 7.0.0 ≤ 7.0.3 ; affected 6.4.0 ≤ 6.4.8 ; affected 6.2.0 ≤ 6.2.9 ; affected 6.0.0 ≤ 6.0.12 ; affected 5.4.0 ≤ 5.4.12
Fortinet · FortiDDoS-Faffected 6.3.0 ≤ 6.3.3 ; affected 6.2.0 ≤ 6.2.3 ; affected 6.1.0 ≤ 6.1.5
Fortinet · FortiSwitchaffected 7.0.0 ≤ 7.0.4 ; affected 6.4.0 ≤ 6.4.10 ; affected 6.2.0 ≤ 6.2.8 ; affected 6.0.0 ≤ 6.0.7
Fortinet · FortiProxyaffected 7.0.0 ≤ 7.0.4 ; affected 2.0.0 ≤ 2.0.14 ; affected 1.2.0 ≤ 1.2.13 ; affected 1.1.0 ≤ 1.1.6 ; affected 1.0.0 ≤ 1.0.7

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD