CVE-2021-43074

Published Feb 16, 2023 CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Description

An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Fortinet

FortiSwitch

unaffected

Version	Status	Constraints
`7.0.0`	affected	≤ 7.0.3
`6.4.0`	affected	≤ 6.4.10
`6.2.0`	affected	≤ 6.2.7
`6.0.0`	affected	≤ 6.0.7

Fortinet

FortiWeb

unaffected

Version	Status	Constraints
`6.4.0`	affected	≤ 6.4.2
`6.3.0`	affected	≤ 6.3.16
`6.2.0`	affected	≤ 6.2.7
`6.1.0`	affected	≤ 6.1.3
`6.0.0`	affected	≤ 6.0.8

Fortinet

FortiProxy

unaffected

Version	Status	Constraints
`7.0.0`	affected	≤ 7.0.1
`2.0.0`	affected	≤ 2.0.7
`1.2.0`	affected	≤ 1.2.13
`1.1.0`	affected	≤ 1.1.6
`1.0.0`	affected	≤ 1.0.7

Fortinet

FortiOS

unaffected

Version	Status	Constraints
`7.0.0`	affected	≤ 7.0.3
`6.4.0`	affected	≤ 6.4.8
`6.2.0`	affected	≤ 6.2.12
`6.0.0`	affected	≤ 6.0.16

Configuration 1 [-]

OR	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiweb::::::::
	cpe:2.3:a:fortinet:fortiweb::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortiswitch::::::::
	cpe:2.3:o:fortinet:fortiswitch::::::::

No data.

No data available yet.

Remediation

Vendor Solution

Upgrade to FortiOS version 7.0.7 or above. Upgrade to FortiOS version 6.4.9 or above. Upgrade to FortiWeb version 7.0.0 or above. upgrade to FortiWeb version 6.3.17 or above. Upgrade to FortiProxy version 7.0.7 or above. Upgrade to FortiProxy version 2.0.8 or above. Upgrade to FortiSwitch version 7.2.0 or above. Upgrade to FortiSwitch version 7.0.4 or above. Upgrade to FortiSwitch version 6.4.11 or above.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2021-30027	An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter.