Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-41025

Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an instance of concurrent execution using shared resource with improper synchronization and one of authentication bypass by capture-replay, may allow a remote unauthenticated attacker to circumvent the authentication process and authenticate as a legitimate cluster peer.

Published

2021-12-08T19:15:09.957

Last Modified

2024-11-21T06:25:17.647

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.3 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-362
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application fortinet fortiweb ≤ 6.0.7 Yes
Application fortinet fortiweb ≤ 6.2.6 Yes
Application fortinet fortiweb ≤ 6.3.15 Yes
Application fortinet fortiweb 6.1.0 Yes
Application fortinet fortiweb 6.1.1 Yes
Application fortinet fortiweb 6.1.2 Yes
Application fortinet fortiweb 6.4.0 Yes
Application fortinet fortiweb 6.4.1 Yes
Application fortinet fortiweb 6.4.2 Yes
References