4.3

CVE-2021-43074

An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter.

Data is provided by the National Vulnerability Database (NVD)
Fortinet ≫ Fortiproxy Version >= 1.0.0 < 2.0.8
Fortinet ≫ Fortiproxy Version >= 7.0.0 < 7.0.2
Fortinet ≫ Fortiweb Version >= 6.0.0 < 6.3.17
Fortinet ≫ Fortiweb Version >= 6.4.0 < 7.0.0
Fortinet ≫ Fortios Version >= 6.0.0 < 6.4.9
Fortinet ≫ Fortios Version >= 7.0.0 < 7.0.4
Fortinet ≫ Fortiswitch Version >= 6.0.0 < 6.4.11
Fortinet ≫ Fortiswitch Version >= 7.0.0 < 7.0.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.09% 0.23
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
psirt@fortinet.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.