CVE-2022-23439

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-22 · updated 2026-06-17
Weakness: CWE-610

Description

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

Affected products

Fortinet FortiADC: from 5.4.0 before 6.2.4 — fixed in 6.2.4
Fortinet FortiAuthenticator: from 6.3.0 before 6.3.4; from 6.4.0 before 6.4.2 — fixed in 6.3.4, 6.4.2
Fortinet FortiDDoS: from 5.3.0 before 5.5.2 — fixed in 5.5.2
Fortinet FortiDDoS-F: from 6.1.0 before 6.3.4 — fixed in 6.3.4
Fortinet FortiMail: from 6.4.0 before 7.0.4 — fixed in 7.0.4
Fortinet FortiNDR: from 1.4.0 before 7.1.1; 7.2.0 — fixed in 7.1.1
Fortinet FortiOS (FortiGate): from 6.0.0 before 7.0.6; from 7.2.0 before 7.2.5 — fixed in 7.0.6, 7.2.5
Fortinet FortiProxy: from 2.0.0 before 7.0.5; from 7.2.0 before 7.4.0 — fixed in 7.0.5, 7.4.0
Fortinet FortiRecorder: from 6.0.0 before 6.0.11; from 6.4.0 before 6.4.3 — fixed in 6.0.11, 6.4.3
Fortinet FortiSOAR: from 6.4.0 before 7.3.0 — fixed in 7.3.0
Fortinet FortiSwitch: from 6.4.0 before 7.0.5 — fixed in 7.0.5
Fortinet FortiTester: from 3.7.0 before 7.2.2 — fixed in 7.2.2
Fortinet FortiVoice: from 6.0.0 before 6.4.9 — fixed in 6.4.9
Fortinet FortiWLC: from 8.6.0 before 8.6.7 — fixed in 8.6.7

How to fix

Upgrade to a fixed version: Fortinet FortiADC 6.2.4; Fortinet FortiAuthenticator 6.3.4, 6.4.2; Fortinet FortiDDoS 5.5.2; Fortinet FortiDDoS-F 6.3.4; Fortinet FortiMail 7.0.4; Fortinet FortiNDR 7.1.1; Fortinet FortiOS (FortiGate) 7.0.6, 7.2.5; Fortinet FortiProxy 7.0.5, 7.4.0; Fortinet FortiRecorder 6.0.11, 6.4.3; Fortinet FortiSOAR 7.3.0; Fortinet FortiSwitch 7.0.5; Fortinet FortiTester 7.2.2. Check the vendor advisory for mitigations.

References

https://fortiguard.com/psirt/FG-IR-23-494

Get alerted when CVE-2022-23439 or the next vulnerability affects your stack