PT-2021-21153 · Fortinet · Forticlient

Published 2021-12-09 · Updated 2022-07-12 · CVE-2021-36167

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiClient Windows versions 6.2.8 and below FortiClient Windows versions 6.4.6 and below FortiClient Windows version 7.0.0

Description An improper authorization issue may allow an unauthenticated attacker to bypass the webfilter control via modifying the session-id parameter. This could potentially lead to unauthorized access.

Recommendations For FortiClient Windows versions 6.2.8 and below, update to a version above 6.2.8 to resolve the issue. For FortiClient Windows versions 6.4.6 and below, update to a version above 6.4.6 to resolve the issue. For FortiClient Windows version 7.0.0, update to a version above 7.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the webfilter control to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-36167

Affected Products

Forticlient

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-36167 · Security Note
• https://fortiguard.com/advisory/FG-IR-20-127 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36167 · Vendor Advisory
• https://t.me/cvenotify/24523 · Telegram Post