6.1

CVE-2022-23439

A externally controlled reference to a resource in another sphere in Fortinet FortiManager before version 7.4.3, FortiMail before version 7.0.3, FortiAnalyzer before version 7.4.3, FortiVoice version 7.0.0, 7.0.1 and before 6.4.8, FortiProxy before version 7.0.4, FortiRecorder version 6.4.0 through 6.4.2 and before 6.0.10, FortiAuthenticator version 6.4.0 through 6.4.1 and before 6.3.3, FortiNDR version 7.2.0 before 7.1.0, FortiWLC before version 8.6.4, FortiPortal before version 6.0.9, FortiOS version 7.2.0 and before 7.0.5, FortiADC version 7.0.0 through 7.0.1 and before 6.2.3 , FortiDDoS before version 5.5.1, FortiDDoS-F before version 6.3.3, FortiTester before version 7.2.1, FortiSOAR before version 7.2.2 and FortiSwitch before version 6.3.3 allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

Data is provided by the National Vulnerability Database (NVD)
Fortinet ≫ Fortiadc Version >= 5.4.0 < 6.2.4
Fortinet ≫ Fortiauthenticator Version >= 6.3.0 < 6.3.4
Fortinet ≫ Fortiauthenticator Version >= 6.4.0 < 6.4.2
Fortinet ≫ Fortiddos Version >= 5.3.0 < 5.5.2
Fortinet ≫ Fortiddos-f Version >= 6.1.0 < 6.3.4
Fortinet ≫ Fortimail Version >= 6.4.0 < 7.0.4
Fortinet ≫ FortiNDR Version >= 1.4.0 < 7.1.1
Fortinet ≫ FortiNDR Version7.2.0
Fortinet ≫ Fortiproxy Version >= 2.0.0 < 7.0.5
Fortinet ≫ Fortiproxy Version >= 7.2.0 < 7.4.0
Fortinet ≫ Fortirecorder Version >= 6.0.0 < 6.0.11
Fortinet ≫ Fortirecorder Version >= 6.4.0 < 6.4.3
Fortinet ≫ Fortisoar Version >= 6.4.0 < 7.3.0
Fortinet ≫ Fortitester Version >= 3.7.0 < 7.2.2
Fortinet ≫ Fortivoice Version >= 6.0.0 < 6.4.9
Fortinet ≫ Fortiwlc Version >= 8.6.0 < 8.6.7
Fortinet ≫ Fortios Version >= 6.0.0 < 7.0.6
Fortinet ≫ Fortios Version >= 7.2.0 < 7.2.5
Fortinet ≫ Fortiswitch Version >= 6.4.0 < 7.0.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.06% 0.194
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
psirt@fortinet.com 4.7 1.6 2.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-610 Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.