PT-2021-21172 · Fortinet · Fortiweb

Published 2021-12-08 · Updated 2023-08-08 · CVE-2021-36190

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 6.4.1 and below Fortinet FortiWeb versions 6.3.15 and below

Description The issue involves an unintended proxy or intermediary, referred to as a 'confused deputy', which allows an unauthenticated attacker to access protected hosts. This is achieved through crafted HTTP requests.

Recommendations For Fortinet FortiWeb versions 6.4.1 and below, update to a version above 6.4.1 to resolve the issue. For Fortinet FortiWeb versions 6.3.15 and below, update to a version above 6.3.15 to resolve the issue. As a temporary workaround, consider restricting access to the HTTP request handling mechanism to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-36190

Affected Products

Fortiweb

References · 4

• https://fortiguard.com/advisory/FG-IR-21-123 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36190 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36190 · Security Note
• https://t.me/cibsecurity/33584 · Telegram Post