CVE-2021-43074

2023-02-1619:15:11

CWE-347

[email protected]

web.nvd.nist.gov

cve-2021-43074

cryptographic signature vulnerability

fortiweb

fortios

fortiswitch

fortiproxy

nvd

cwe-347

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C

4.6 Medium

AI Score

Confidence

High

JSON

An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter.

CPE configuration

NVD

fortinetfortiproxyRange1.0.0–2.0.8

fortinetfortiproxyRange7.0.0–7.0.2

fortinetfortiwebRange6.0.0–6.3.17

fortinetfortiwebRange6.4.0–7.0.0

fortinetfortiosRange6.0.0–6.4.9

fortinetfortiosRange7.0.0–7.0.4

fortinetfortiswitchRange6.0.0–6.4.11

fortinetfortiswitchRange7.0.0–7.0.4

CPENameOperatorVersion
fortinet:fortiproxyfortinet fortiproxylt2.0.8
fortinet:fortiproxyfortinet fortiproxylt7.0.2
fortinet:fortiwebfortinet fortiweblt6.3.17
fortinet:fortiwebfortinet fortiweblt7.0.0
fortinet:fortiosfortinet fortioslt6.4.9
fortinet:fortiosfortinet fortioslt7.0.4
fortinet:fortiswitchfortinet fortiswitchlt6.4.11
fortinet:fortiswitchfortinet fortiswitchlt7.0.4

CPE	Name	Operator	Version
fortinet:fortiproxy	fortinet fortiproxy	lt	2.0.8
fortinet:fortiproxy	fortinet fortiproxy	lt	7.0.2
fortinet:fortiweb	fortinet fortiweb	lt	6.3.17
fortinet:fortiweb	fortinet fortiweb	lt	7.0.0
fortinet:fortios	fortinet fortios	lt	6.4.9
fortinet:fortios	fortinet fortios	lt	7.0.4
fortinet:fortiswitch	fortinet fortiswitch	lt	6.4.11
fortinet:fortiswitch	fortinet fortiswitch	lt	7.0.4

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiSwitch",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.3",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.10",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.7",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiWeb",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.3.0",
        "lessThanOrEqual": "6.3.16",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.1.0",
        "lessThanOrEqual": "6.1.3",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.8",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiProxy",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "2.0.0",
        "lessThanOrEqual": "2.0.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "1.2.0",
        "lessThanOrEqual": "1.2.13",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "1.1.0",
        "lessThanOrEqual": "1.1.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "1.0.0",
        "lessThanOrEqual": "1.0.7",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiOS",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.3",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.8",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.12",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.16",
        "status": "affected"
      }
    ]
  }
]