CVE-2022-23439, CoreCVE

Back Back to CVE browser

MEDIUM

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

Published Jan 22, 2025

6.1

MEDIUM

CVSS 3.1

EPSS 0.45%

Description

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

Affected products

Vendor Fortinet Product FortiADC Default
unaffected
- Version
  5.0.0
  Status
  affected
  Constraints
  <=5.0.4
- Version
  5.1.0
  Status
  affected
  Constraints
  <=5.1.7
- Version
  5.2.0
  Status
  affected
  Constraints
  <=5.2.8
- Version
  5.3.0
  Status
  affected
  Constraints
  <=5.3.7
- Version
  5.4.0
  Status
  affected
  Constraints
  <=5.4.5
- Version
  6.0.0
  Status
  affected
  Constraints
  <=6.0.4
- Version
  6.1.0
  Status
  affected
  Constraints
  <=6.1.6
- Version
  6.2.0
  Status
  affected
  Constraints
  <=6.2.3
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.1
Vendor Fortinet Product FortiAnalyzer Default
unaffected
- Version
  6.2.0
  Status
  affected
  Constraints
  <=6.2.13
- Version
  6.4.0
  Status
  affected
  Constraints
  <=6.4.15
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.15
- Version
  7.2.0
  Status
  affected
  Constraints
  <=7.2.11
- Version
  7.4.0
  Status
  affected
  Constraints
  <=7.4.2
Vendor Fortinet Product FortiAuthenticator Default
unaffected
- Version
  5.1.0
  Status
  affected
  Constraints
  <=5.1.2
- Version
  5.2.0
  Status
  affected
  Constraints
  <=5.2.2
- Version
  5.3.0
  Status
  affected
  Constraints
  <=5.3.1
- Version
  5.4.0
  Status
  affected
  Constraints
  <=5.4.1
- Version
  5.5.0
  Status
  affected
  Constraints
  -
- Version
  6.0.0
  Status
  affected
  Constraints
  <=6.0.8
- Version
  6.1.0
  Status
  affected
  Constraints
  <=6.1.3
- Version
  6.2.0
  Status
  affected
  Constraints
  <=6.2.2
- Version
  6.3.0
  Status
  affected
  Constraints
  <=6.3.3
- Version
  6.4.0
  Status
  affected
  Constraints
  <=6.4.1
Vendor Fortinet Product FortiDDoS Default
unaffected
- Version
  4.5.0
  Status
  affected
  Constraints
  -
- Version
  4.6.0
  Status
  affected
  Constraints
  -
- Version
  4.7.0
  Status
  affected
  Constraints
  -
- Version
  5.0.0
  Status
  affected
  Constraints
  -
- Version
  5.1.0
  Status
  affected
  Constraints
  -
- Version
  5.2.0
  Status
  affected
  Constraints
  -
- Version
  5.3.0
  Status
  affected
  Constraints
  <=5.3.2
- Version
  5.4.0
  Status
  affected
  Constraints
  <=5.4.3
- Version
  5.5.0
  Status
  affected
  Constraints
  <=5.5.1
Vendor Fortinet Product FortiDDoS-F Default
unaffected
- Version
  6.1.0
  Status
  affected
  Constraints
  <=6.1.5
- Version
  6.2.0
  Status
  affected
  Constraints
  <=6.2.3
- Version
  6.3.0
  Status
  affected
  Constraints
  <=6.3.3
Vendor Fortinet Product FortiMail Default
unaffected
- Version
  5.4.0
  Status
  affected
  Constraints
  <=5.4.12
- Version
  6.0.0
  Status
  affected
  Constraints
  <=6.0.12
- Version
  6.2.0
  Status
  affected
  Constraints
  <=6.2.9
- Version
  6.4.0
  Status
  affected
  Constraints
  <=6.4.8
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.3
Vendor Fortinet Product FortiManager Default
unaffected
- Version
  6.2.0
  Status
  affected
  Constraints
  <=6.2.13
- Version
  6.4.0
  Status
  affected
  Constraints
  <=6.4.15
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.15
- Version
  7.2.0
  Status
  affected
  Constraints
  <=7.2.11
- Version
  7.4.0
  Status
  affected
  Constraints
  <=7.4.3
Vendor Fortinet Product FortiNDR Default
unaffected
- Version
  1.1.0
  Status
  affected
  Constraints
  -
- Version
  1.2.0
  Status
  affected
  Constraints
  -
- Version
  1.3.0
  Status
  affected
  Constraints
  <=1.3.1
- Version
  1.4.0
  Status
  affected
  Constraints
  -
- Version
  1.5.0
  Status
  affected
  Constraints
  <=1.5.3
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.7
- Version
  7.1.0
  Status
  affected
  Constraints
  -
- Version
  7.2.0
  Status
  affected
  Constraints
  -
Vendor Fortinet Product FortiOS Default
unaffected
- Version
  6.0.0
  Status
  affected
  Constraints
  <=6.0.18
- Version
  6.2.0
  Status
  affected
  Constraints
  <=6.2.17
- Version
  6.4.0
  Status
  affected
  Constraints
  <6.4.*
- Version
  6.4.0
  Status
  affected
  Constraints
  <=6.4.16
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.5
- Version
  7.2.0
  Status
  affected
  Constraints
  -
Vendor Fortinet Product FortiPortal Default
unaffected
- Version
  6.0.0
  Status
  affected
  Constraints
  <=6.0.9
Vendor Fortinet Product FortiProxy Default
unaffected
- Version
  1.0.0
  Status
  affected
  Constraints
  <=1.0.7
- Version
  1.1.0
  Status
  affected
  Constraints
  <=1.1.6
- Version
  1.2.0
  Status
  affected
  Constraints
  <=1.2.13
- Version
  2.0.0
  Status
  affected
  Constraints
  <=2.0.14
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.4
Vendor Fortinet Product FortiRecorder Default
unaffected
- Version
  2.6.0
  Status
  affected
  Constraints
  <=2.6.3
- Version
  2.7.0
  Status
  affected
  Constraints
  <=2.7.7
- Version
  6.0.0
  Status
  affected
  Constraints
  <=6.0.10
- Version
  6.4.0
  Status
  affected
  Constraints
  <=6.4.2
Vendor Fortinet Product FortiSOAR on-premise Default
unaffected
- Version
  6.4.0
  Status
  affected
  Constraints
  <=6.4.1
- Version
  6.4.3
  Status
  affected
  Constraints
  <=6.4.4
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.3
- Version
  7.2.0
  Status
  affected
  Constraints
  <=7.2.2
Vendor Fortinet Product FortiSwitch Default
unaffected
- Version
  6.0.0
  Status
  affected
  Constraints
  <=6.0.7
- Version
  6.2.0
  Status
  affected
  Constraints
  <=6.2.8
- Version
  6.4.0
  Status
  affected
  Constraints
  <=6.4.10
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.4
Vendor Fortinet Product FortiTester Default
unaffected
- Version
  3.3.0
  Status
  affected
  Constraints
  <=3.3.1
- Version
  3.4.0
  Status
  affected
  Constraints
  -
- Version
  3.5.0
  Status
  affected
  Constraints
  <=3.5.1
- Version
  3.6.0
  Status
  affected
  Constraints
  -
- Version
  3.7.0
  Status
  affected
  Constraints
  <=3.7.1
- Version
  3.8.0
  Status
  affected
  Constraints
  -
- Version
  3.9.0
  Status
  affected
  Constraints
  <=3.9.2
- Version
  4.0.0
  Status
  affected
  Constraints
  -
- Version
  4.1.0
  Status
  affected
  Constraints
  <=4.1.1
- Version
  4.2.0
  Status
  affected
  Constraints
  <=4.2.1
- Version
  7.0.0
  Status
  affected
  Constraints
  -
- Version
  7.1.0
  Status
  affected
  Constraints
  <=7.1.1
- Version
  7.2.0
  Status
  affected
  Constraints
  <=7.2.1
Vendor Fortinet Product FortiVoice Default
unaffected
- Version
  6.0.0
  Status
  affected
  Constraints
  <=6.0.11
- Version
  6.4.0
  Status
  affected
  Constraints
  <=6.4.8
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.1
Vendor Fortinet Product FortiWLC Default
unaffected
- Version
  8.4.0
  Status
  affected
  Constraints
  <=8.4.2
- Version
  8.4.4
  Status
  affected
  Constraints
  <=8.4.8
- Version
  8.5.0
  Status
  affected
  Constraints
  <=8.5.5
- Version
  8.6.0
  Status
  affected
  Constraints
  <=8.6.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fortinet

FortiADC

unaffected

Version	Status	Constraints
5.0.0	affected	<=5.0.4
5.1.0	affected	<=5.1.7
5.2.0	affected	<=5.2.8
5.3.0	affected	<=5.3.7
5.4.0	affected	<=5.4.5
6.0.0	affected	<=6.0.4
6.1.0	affected	<=6.1.6
6.2.0	affected	<=6.2.3
7.0.0	affected	<=7.0.1

Fortinet

FortiAnalyzer

unaffected

Version	Status	Constraints
6.2.0	affected	<=6.2.13
6.4.0	affected	<=6.4.15
7.0.0	affected	<=7.0.15
7.2.0	affected	<=7.2.11
7.4.0	affected	<=7.4.2

Fortinet

FortiAuthenticator

unaffected

Version	Status	Constraints
5.1.0	affected	<=5.1.2
5.2.0	affected	<=5.2.2
5.3.0	affected	<=5.3.1
5.4.0	affected	<=5.4.1
5.5.0	affected	-
6.0.0	affected	<=6.0.8
6.1.0	affected	<=6.1.3
6.2.0	affected	<=6.2.2
6.3.0	affected	<=6.3.3
6.4.0	affected	<=6.4.1

Fortinet

FortiDDoS

unaffected

Version	Status	Constraints
4.5.0	affected	-
4.6.0	affected	-
4.7.0	affected	-
5.0.0	affected	-
5.1.0	affected	-
5.2.0	affected	-
5.3.0	affected	<=5.3.2
5.4.0	affected	<=5.4.3
5.5.0	affected	<=5.5.1

Fortinet

FortiDDoS-F

unaffected

Version	Status	Constraints
6.1.0	affected	<=6.1.5
6.2.0	affected	<=6.2.3
6.3.0	affected	<=6.3.3

Fortinet

FortiMail

unaffected

Version	Status	Constraints
5.4.0	affected	<=5.4.12
6.0.0	affected	<=6.0.12
6.2.0	affected	<=6.2.9
6.4.0	affected	<=6.4.8
7.0.0	affected	<=7.0.3

Fortinet

FortiManager

unaffected

Version	Status	Constraints
6.2.0	affected	<=6.2.13
6.4.0	affected	<=6.4.15
7.0.0	affected	<=7.0.15
7.2.0	affected	<=7.2.11
7.4.0	affected	<=7.4.3

Fortinet

FortiNDR

unaffected

Version	Status	Constraints
1.1.0	affected	-
1.2.0	affected	-
1.3.0	affected	<=1.3.1
1.4.0	affected	-
1.5.0	affected	<=1.5.3
7.0.0	affected	<=7.0.7
7.1.0	affected	-
7.2.0	affected	-

Fortinet

FortiOS

unaffected

Version	Status	Constraints
6.0.0	affected	<=6.0.18
6.2.0	affected	<=6.2.17
6.4.0	affected	<6.4.*
6.4.0	affected	<=6.4.16
7.0.0	affected	<=7.0.5
7.2.0	affected	-

Fortinet

FortiPortal

unaffected

Version	Status	Constraints
6.0.0	affected	<=6.0.9

Fortinet

FortiProxy

unaffected

Version	Status	Constraints
1.0.0	affected	<=1.0.7
1.1.0	affected	<=1.1.6
1.2.0	affected	<=1.2.13
2.0.0	affected	<=2.0.14
7.0.0	affected	<=7.0.4

Fortinet

FortiRecorder

unaffected

Version	Status	Constraints
2.6.0	affected	<=2.6.3
2.7.0	affected	<=2.7.7
6.0.0	affected	<=6.0.10
6.4.0	affected	<=6.4.2

Fortinet

FortiSOAR on-premise

unaffected

Version	Status	Constraints
6.4.0	affected	<=6.4.1
6.4.3	affected	<=6.4.4
7.0.0	affected	<=7.0.3
7.2.0	affected	<=7.2.2

Fortinet

FortiSwitch

unaffected

Version	Status	Constraints
6.0.0	affected	<=6.0.7
6.2.0	affected	<=6.2.8
6.4.0	affected	<=6.4.10
7.0.0	affected	<=7.0.4

Fortinet

FortiTester

unaffected

Version	Status	Constraints
3.3.0	affected	<=3.3.1
3.4.0	affected	-
3.5.0	affected	<=3.5.1
3.6.0	affected	-
3.7.0	affected	<=3.7.1
3.8.0	affected	-
3.9.0	affected	<=3.9.2
4.0.0	affected	-
4.1.0	affected	<=4.1.1
4.2.0	affected	<=4.2.1
7.0.0	affected	-
7.1.0	affected	<=7.1.1
7.2.0	affected	<=7.2.1

Fortinet

FortiVoice

unaffected

Version	Status	Constraints
6.0.0	affected	<=6.0.11
6.4.0	affected	<=6.4.8
7.0.0	affected	<=7.0.1

Fortinet

FortiWLC

unaffected

Version	Status	Constraints
8.4.0	affected	<=8.4.2
8.4.4	affected	<=8.4.8
8.5.0	affected	<=8.5.5
8.6.0	affected	<=8.6.7

Remediation

Vendor solution

FortiOS Administrative Interface Upgrade to FortiOS version 7.0.6 and above, Upgrade to FortiOS version 7.2.1 and above. AND Set the `admin-host` property to the device hostname, which will disable `Host redirection`: config system global set admin-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection"

SSLVPN interface Upgrade to FortiOS version 7.4.0 or above Upgrade to FortiOS version 7.2.5 or above AND Set the `server-hostname` property to the device hostname, which will disable `Host redirection` for SSL VPN: config vpn ssl settings set server-hostname Server hostname for HTTPS. When set, will be used for SSL VPN web proxy host header for any redirection.

Webfilter interface (port 8008) Upgrade to FortiOS version 7.4.0 or above Upgrade to FortiOS version 7.2.5 or above Upgrade to FortiOS version 7.0.12 or above Upgrade to FortiOS version 6.4.13 or above

FortiProxy Administrative Interface Upgrade to FortiProxy version 7.0.5 and above AND Set the `admin-host` property to the device hostname, which will disable `Host redirection`: config system global set admin-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection"

SSLVPN interface Upgrade to FortiProxy version 7.4.0 or above AND Set the `server-hostname` property to the device hostname, which will disable `Host redirection` for SSL VPN: config vpn ssl settings set server-hostname Server hostname for HTTPS. When set, will be used for SSL VPN web proxy host header for any redirection.

WebFilter interface (port 8008) Upgrade to FortiProxy version 7.4.0 or above

Upgrade to FortiRecorder version 7.0.0 or above Upgrade to FortiRecorder version 6.4.3 or above Upgrade to FortiRecorder version 6.0.11 or above Upgrade to FortiNDR version 7.4.0 or above

FortiAnalyzer & FortiManager

Upgrade to version 7.6.0 or above Upgrade to version 7.4.4 or above

Set the `admin-host` property to the device hostname, which will disable `Host redirection` for administrative interface. config system global set admin-host end

FortiNDR Upgrade to FortiNDR version 7.2.1 or above Upgrade to FortiNDR version 7.1.1 or above AND Set the `https-redirect-host` property to the device hostname, which will disable `Host redirection`: config system global set https-redirect-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection" end

FortiADC Upgrade to FortiADC version 7.1.0 or above Upgrade to FortiADC version 7.0.2 or above Upgrade to FortiADC version 6.2.4 or above AND Set the `admin-host` property to the device hostname, which will disable `Host redirection`: config system global set admin-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection"

FortiDDOS-F Upgrade to FortiDDoS-F version 6.4.0 or above Upgrade to FortiDDoS-F version 6.3.4 or above AND Set the `admin-host` property to the device hostname, which will disable `Host redirection`: config system global set admin-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection"

Upgrade to FortiSwitch version 7.2.0 or above Upgrade to FortiSwitch version 7.0.5 or above Upgrade to FortiSwitch version 6.4.11 or above Upgrade to FortiVoice version 7.0.2 or above Upgrade to FortiVoice version 6.4.9 or above Upgrade to FortiMail version 7.2.0 or above Upgrade to FortiMail version 7.0.4 or above Upgrade to FortiWLC version 8.6.7 or above Upgrade to FortiAuthenticator version 6.4.2 or above Upgrade to FortiAuthenticator version 6.3.4 or above Upgrade to FortiDDoS version 5.6.0 or above Upgrade to FortiDDoS version 5.5.2 or above Upgrade to FortiSOAR version 7.3.0 or above Upgrade to FortiTester version 7.3.0 or above Upgrade to FortiTester version 7.2.2 or above

Metrics

0.45% 0.00449

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00449

Score over time

2025–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (4 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.45% (0.00449)	36.66th	v5 (v2026.06.15)
Jun 15, 2026	0.43% (0.00429)	34.01th	v5 (v2026.06.15)
Mar 17, 2025	0.06% (0.00056)	14.65th	v4 (v2025.03.14)
Jan 23, 2025	0.04% (0.00043)	11.40th	v3 (v2023.03.01)

Weaknesses (1)

CWE-610

References (1)

https://fortiguard.com/psirt/FG-IR-23-494

Link	Providers	Tags
https://fortiguard.com/psirt/FG-IR-23-494

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner fortinet

Published Jan 22, 2025

Updated Jan 14, 2026

Reserved Jan 19, 2022

Link CVE-2022-23439

CISA Vulnrichment

Updated Jan 22, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-23439

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-23439