Security readout for executives and security teams
Plain-English summary
CVE-2022-23439 is a Fortinet web cache poisoning issue. A crafted HTTP request using an attacker-controlled Host header could cause cached content to reference an arbitrary external web server. The impact is limited but business-relevant where affected Fortinet web interfaces are reachable and cached content is trusted by users.
Executive priority
Treat this as a targeted remediation item, not an emergency. Prioritize internet-facing or widely used Fortinet management and service portals, then fold remaining affected products into normal vulnerability management timelines after vendor version validation.
Technical view
The issue is CWE-610, externally controlled reference to a resource in another sphere. The CVSS 3.1 score is 4.1, with network attack vector, high complexity, no privileges, user interaction required, changed scope, and low confidentiality and integrity impact. The bundle lists multiple Fortinet product families and versions as affected.
Likely exposure
Exposure is most likely in environments running listed Fortinet products where HTTP responses from affected interfaces pass through shared caches, reverse proxies, or user-facing web paths. The affected set spans FortiOS, FortiProxy, FortiManager, FortiAnalyzer, FortiMail, FortiADC, FortiAuthenticator, and other listed Fortinet products.
Exploitation context
The source bundle does not show CISA KEV status or active exploitation. Exploitation appears constrained by high attack complexity and required user interaction, but it is remote and unauthenticated. Risk rises if affected Fortinet interfaces are internet-facing or cached for multiple users.
Researcher notes
Evidence is limited to the CVE record, CVE List data, and Fortinet advisory reference. The bundle names many affected product families but does not provide exploit details or exact fixed versions. Avoid assuming exploitation or product impact outside the listed affected data.
Mitigation direction
- Review Fortinet PSIRT FG-IR-23-494 for fixed versions and upgrade guidance.
- Inventory listed Fortinet products and compare versions against the advisory.
- Reduce public access to affected web interfaces where operationally possible.
- Review cache and reverse-proxy handling for untrusted Host headers.
Validation and detection
- Identify deployed Fortinet products and exact firmware or software versions.
- Confirm whether affected interfaces are reachable from untrusted networks.
- Check for shared caching or reverse-proxy layers in front of Fortinet interfaces.
- Verify remediation status against Fortinet PSIRT guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-610: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-23439 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C1.62.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.1MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.com/psirt/FG-IR-23-494CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Externally Controlled Reference to a Resource in Another Sphere
Externally Controlled Reference to a Resource in Another Sphere represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.