Lucene search

FortinetCVE-2021-41024

HistoryDec 08, 2021 - 1:15 p.m.

CVE-2021-41024

2021-12-0813:15:07

CWE-22

fortinet

web.nvd.nist.gov

cve-2021-41024

fortios

fortiproxy

path traversal

vulnerability

information disclosure

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

High

EPSS

0.002

Percentile

65.1%

JSON

A relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page.

Affected configurations

Nvd

Node

fortinetfortiproxyMatch7.0.0

fortinetfortiosMatch7.0.0

fortinetfortiosMatch7.0.1

VendorProductVersionCPE
fortinetfortiproxy7.0.0cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*
fortinetfortios7.0.0cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*
fortinetfortios7.0.1cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiproxy	7.0.0	cpe:2.3:a:fortinet:fortiproxy:7.0.0:::::::*
fortinet	fortios	7.0.0	cpe:2.3:o:fortinet:fortios:7.0.0:::::::*
fortinet	fortios	7.0.1	cpe:2.3:o:fortinet:fortios:7.0.1:::::::*

CNA Affected

[
  {
    "product": "Fortinet FortiOS",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiOS 7.0.1, 7.0.0 FortiProxy 7.0.0"
      }
    ]
  }
]

References

fortiguard.com/advisory/FG-IR-21-181

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

High

EPSS

0.002

Percentile

65.1%

JSON

Related for CVE-2021-41024