PT-2021-21173 · Fortinet · Fortiweb

Published 2021-12-08 · Updated 2021-12-15 · CVE-2021-36191

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 6.4.1 and below Fortinet FortiWeb versions 6.3.15 and below

Description The issue allows an attacker to use the device as a proxy via crafted GET parameters in requests to error handlers, due to a url redirection to untrusted sites, also known as an 'open redirect'.

Recommendations For Fortinet FortiWeb versions 6.4.1 and below, update to a version above 6.4.1 to resolve the issue. For Fortinet FortiWeb versions 6.3.15 and below, update to a version above 6.3.15 to resolve the issue. As a temporary workaround, consider restricting access to error handlers to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-36191

Affected Products

Fortiweb

References · 5

• https://osv.dev/vulnerability/CVE-2021-36191 · Vendor Advisory
• https://fortiguard.com/advisory/FG-IR-21-133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36191 · Security Note
• https://t.me/cibsecurity/33579 · Telegram Post
• https://t.me/cvenotify/24481 · Telegram Post