CVE-2021-43074
Description
An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter.
How to fix
- fortinet fortiproxy2.0.8, 7.0.2 or later
- fortinet fortiweb6.3.17, 7.0.0 or later
- fortinet fortios6.4.9, 7.0.4 or later
- fortinet fortiswitch6.4.11, 7.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortiproxy | 1.0.0 ≤ v < 2.0.8, 7.0.0 ≤ v < 7.0.2 | 2.0.8, 7.0.2 |
| fortinet fortiweb | 6.0.0 ≤ v < 6.3.17, 6.4.0 ≤ v < 7.0.0 | 6.3.17, 7.0.0 |
| fortinet fortios | 6.0.0 ≤ v < 6.4.9, 7.0.0 ≤ v < 7.0.4 | 6.4.9, 7.0.4 |
| fortinet fortiswitch | 6.0.0 ≤ v < 6.4.11, 7.0.0 ≤ v < 7.0.4 | 6.4.11, 7.0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.