PT-2021-21168 · Fortinet · Fortiweb

Published 2021-11-02 · Updated 2021-11-04 · CVE-2021-36187

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 6.4.0, 6.3.15 and below, 6.2.5 and below

Description The issue is related to uncontrolled resource consumption, allowing an attacker to cause a denial of service for the webserver daemon via crafted HTTP requests.

Recommendations For Fortinet FortiWeb version 6.4.0, update to a version that fixes the issue. For Fortinet FortiWeb versions 6.3.15 and below, update to a version that fixes the issue. For Fortinet FortiWeb versions 6.2.5 and below, update to a version that fixes the issue.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-36187

Affected Products

Fortiweb

References · 4

• https://fortiguard.com/advisory/FG-IR-21-039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36187 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36187 · Vendor Advisory
• https://t.me/cvenotify/22896 · Telegram Post