PT-2023-1548 · Fortinet · Fortiweb

Published 2023-02-16 · Updated 2023-02-24 · CVE-2021-42761

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiWeb versions 5.9.0 through 5.9.1 FortiWeb versions 6.0.0 through 6.0.7 FortiWeb versions 6.1.0 through 6.1.2 FortiWeb versions 6.2.0 through 6.2.6 FortiWeb versions 6.3.0 through 6.3.16 FortiWeb versions 6.4 all versions

Description A condition in the session management of FortiWeb may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session. This issue is related to a lack of session fixation mechanism. The exploitation of this issue can enable a remote attacker to intercept sessions of other users.

Recommendations For FortiWeb versions 5.9.0 through 5.9.1, update to a version that includes a fix for this issue. For FortiWeb versions 6.0.0 through 6.0.7, update to a version that includes a fix for this issue. For FortiWeb versions 6.1.0 through 6.1.2, update to a version that includes a fix for this issue. For FortiWeb versions 6.2.0 through 6.2.6, update to a version that includes a fix for this issue. For FortiWeb versions 6.3.0 through 6.3.16, update to a version that includes a fix for this issue. For FortiWeb versions 6.4 all versions, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the session management mechanism to minimize the risk of exploitation.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BDU:2023-01003

CVE-2021-42761

Affected Products

Fortiweb

References · 5

• https://fortiguard.com/psirt/FG-IR-21-214 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01003 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42761 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42761 · Security Note
• https://t.me/cibsecurity/58381 · Telegram Post