5.4

CVE-2021-36191

A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to use the device as proxy via crafted GET parameters in requests to error handlers

Data is provided by the National Vulnerability Database (NVD)
Fortinet ≫ Fortiweb Version >= 6.0.0 <= 6.0.7
Fortinet ≫ Fortiweb Version >= 6.2.0 <= 6.2.6
Fortinet ≫ Fortiweb Version >= 6.3.0 <= 6.3.15
Fortinet ≫ Fortiweb Version6.1.0
Fortinet ≫ Fortiweb Version6.1.1
Fortinet ≫ Fortiweb Version6.1.2
Fortinet ≫ Fortiweb Version6.4.0
Fortinet ≫ Fortiweb Version6.4.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.08% 0.213
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.9 6.8 4.9
AV:N/AC:M/Au:S/C:P/I:P/A:N
psirt@fortinet.com 4.1 2.3 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.