Description
A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver
Metrics
CVSS 3.1 6.1/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiTester | >= 7.2.0, <= 7.2.1; >= 7.1.0, <= 7.1.1; 7.0.0; >= 4.2.0, <= 4.2.1; >= 4.1.0, <= 4.1.1; 4.0.0; >= 3.9.0, <= 3.9.2; 3.8.0; >= 3.7.0, <= 3.7.1; 3.6.0; >= 3.5.0, <= 3.5.1; 3.4.0; >= 3.3.0, <= 3.3.1 |
| Fortinet | FortiOS | 7.2.0; >= 7.0.0, <= 7.0.5; >= 6.4.0, <= 6.4.16; >= 6.2.0, <= 6.2.17; >= 6.0.0, <= 6.0.18; >= 6.4.0, < 6.4.* |
| Fortinet | FortiRecorder | >= 6.4.0, <= 6.4.2; >= 6.0.0, <= 6.0.10; >= 2.7.0, <= 2.7.7; >= 2.6.0, <= 2.6.3 |
| Fortinet | FortiNDR | 7.2.0; 7.1.0; >= 7.0.0, <= 7.0.7; >= 1.5.0, <= 1.5.3; 1.4.0; >= 1.3.0, <= 1.3.1; 1.2.0; 1.1.0 |
| Fortinet | FortiADC | >= 7.0.0, <= 7.0.1; >= 6.2.0, <= 6.2.3; >= 6.1.0, <= 6.1.6; >= 6.0.0, <= 6.0.4; >= 5.4.0, <= 5.4.5; >= 5.3.0, <= 5.3.7; >= 5.2.0, <= 5.2.8; >= 5.1.0, <= 5.1.7; >= 5.0.0, <= 5.0.4 |
| Fortinet | FortiManager | >= 7.4.0, <= 7.4.3; >= 7.2.0, <= 7.2.11; >= 7.0.0, <= 7.0.15; >= 6.4.0, <= 6.4.15; >= 6.2.0, <= 6.2.13 |
| Fortinet | FortiVoice | >= 7.0.0, <= 7.0.1; >= 6.4.0, <= 6.4.8; >= 6.0.0, <= 6.0.11 |
| Fortinet | FortiSOAR on-premise | >= 7.2.0, <= 7.2.2; >= 7.0.0, <= 7.0.3; >= 6.4.3, <= 6.4.4; >= 6.4.0, <= 6.4.1 |
| Fortinet | FortiDDoS | >= 5.5.0, <= 5.5.1; >= 5.4.0, <= 5.4.3; >= 5.3.0, <= 5.3.2; 5.2.0; 5.1.0; 5.0.0; 4.7.0; 4.6.0; 4.5.0 |
| Fortinet | FortiWLC | >= 8.6.0, <= 8.6.7; >= 8.5.0, <= 8.5.5; >= 8.4.4, <= 8.4.8; >= 8.4.0, <= 8.4.2 |
| Fortinet | FortiAnalyzer | >= 7.4.0, <= 7.4.2; >= 7.2.0, <= 7.2.11; >= 7.0.0, <= 7.0.15; >= 6.4.0, <= 6.4.15; >= 6.2.0, <= 6.2.13 |
| Fortinet | FortiPortal | >= 6.0.0, <= 6.0.9 |
| Fortinet | FortiAuthenticator | >= 6.4.0, <= 6.4.1; >= 6.3.0, <= 6.3.3; >= 6.2.0, <= 6.2.2; >= 6.1.0, <= 6.1.3; >= 6.0.0, <= 6.0.8; 5.5.0; >= 5.4.0, <= 5.4.1; >= 5.3.0, <= 5.3.1; >= 5.2.0, <= 5.2.2; >= 5.1.0, <= 5.1.2 |
| Fortinet | FortiMail | >= 7.0.0, <= 7.0.3; >= 6.4.0, <= 6.4.8; >= 6.2.0, <= 6.2.9; >= 6.0.0, <= 6.0.12; >= 5.4.0, <= 5.4.12 |
| Fortinet | FortiDDoS-F | >= 6.3.0, <= 6.3.3; >= 6.2.0, <= 6.2.3; >= 6.1.0, <= 6.1.5 |
| Fortinet | FortiSwitch | >= 7.0.0, <= 7.0.4; >= 6.4.0, <= 6.4.10; >= 6.2.0, <= 6.2.8; >= 6.0.0, <= 6.0.7 |
| Fortinet | FortiProxy | >= 7.0.0, <= 7.0.4; >= 2.0.0, <= 2.0.14; >= 1.2.0, <= 1.2.13; >= 1.1.0, <= 1.1.6; >= 1.0.0, <= 1.0.7 |
References
Timeline
- Published
- Jan 22, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Modified