4.3

CVE-2021-43074

An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fortinet ≫ FortiProxy Version >= 1.0.0 < 2.0.8
Fortinet ≫ FortiProxy Version >= 7.0.0 < 7.0.2
Fortinet ≫ Fortiweb Version >= 6.0.0 < 6.3.17
Fortinet ≫ Fortiweb Version >= 6.4.0 < 7.0.0
Fortinet ≫ FortiOS Version >= 6.0.0 < 6.4.9
Fortinet ≫ FortiOS Version >= 7.0.0 < 7.0.4
Fortinet ≫ Fortiswitch Version >= 6.0.0 < 6.4.11
Fortinet ≫ Fortiswitch Version >= 7.0.0 < 7.0.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.202
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fortinet 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

https://fortiguard.com/psirt/FG-IR-21-126
Vendor Advisory