PT-2021-23049 · Fortinet · Fortiweb

Published 2021-12-08 · Updated 2021-12-09 · CVE-2021-41014

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 6.4.1 and below Fortinet FortiWeb versions 6.3.15 and below

Description The issue is related to uncontrolled resource consumption, allowing an unauthenticated attacker to make the httpsd daemon unresponsive via huge HTTP packets.

Recommendations For Fortinet FortiWeb versions 6.4.1 and below, consider restricting access to the httpsd daemon to minimize the risk of exploitation until a patch is available. For Fortinet FortiWeb versions 6.3.15 and below, consider restricting access to the httpsd daemon to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-41014

Affected Products

Fortiweb

References · 4

• https://fortiguard.com/advisory/FG-IR-21-131 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41014 · Security Note
• https://t.me/cibsecurity/33578 · Telegram Post