6.1

CVE-2022-23439

A externally controlled reference to a resource in another sphere vulnerability in Fortinet  allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fortinet ≫ Fortiadc Version >= 5.4.0 < 6.2.4
Fortinet ≫ Fortiauthenticator Version >= 6.3.0 < 6.3.4
Fortinet ≫ Fortiauthenticator Version >= 6.4.0 < 6.4.2
Fortinet ≫ Fortiddos Version >= 5.3.0 < 5.5.2
Fortinet ≫ Fortiddos-f Version >= 6.1.0 < 6.3.4
Fortinet ≫ Fortimail Version >= 6.4.0 < 7.0.4
Fortinet ≫ FortiNDR Version >= 1.4.0 < 7.1.1
Fortinet ≫ FortiNDR Version7.2.0
Fortinet ≫ FortiProxy Version >= 2.0.0 < 7.0.5
Fortinet ≫ FortiProxy Version >= 7.2.0 < 7.4.0
Fortinet ≫ Fortirecorder Version >= 6.0.0 < 6.0.11
Fortinet ≫ Fortirecorder Version >= 6.4.0 < 6.4.3
Fortinet ≫ Fortisoar Version >= 6.4.0 < 7.3.0
Fortinet ≫ Fortitester Version >= 3.7.0 < 7.2.2
Fortinet ≫ Fortivoice Version >= 6.0.0 < 6.4.9
Fortinet ≫ Fortiwlc Version >= 8.6.0 < 8.6.7
Fortinet ≫ FortiOS Version >= 6.0.0 < 7.0.6
Fortinet ≫ FortiOS Version >= 7.2.0 < 7.2.5
Fortinet ≫ Fortiswitch Version >= 6.4.0 < 7.0.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.336
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
psirt@fortinet.com 4.7 1.6 2.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-610 Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.