CVE-2021-26103

🗓️ 08 Dec 2021 12:01:12Reported by fortinetType

An insufficient data authenticity verification vulnerability in FortiProxy and FortiGate SSL VPN portal versions 2.0.3 and below, 1.2.11 and below, 7.0.0, 6.4.6 and below, 6.2.9 and below, allows remote unauthenticated attacker to conduct CSRF attack

Reporter	Title	Published	Views	Family All 12
CNNVD	Fortinet FortiProxy SSL VPN 数据伪造问题漏洞	8 Dec 202100:00	–	cnnvd
CNVD	Fortinet FortiProxy SSL VPN Cross-Site Request Forgery Vulnerability	15 Dec 202100:00	–	cnvd
CVE	CVE-2021-26103	8 Dec 202112:01	–	cve
EUVD	EUVD-2021-12924	7 Oct 202500:30	–	euvd
Fortinet	Protect	7 Dec 202100:00	–	fortinet
Tenable Nessus	Fortinet Fortigate ['CSRF'] (FG-IR-20-158)	29 Oct 202400:00	–	nessus
Tenable Nessus	Fortinet FortiOS CSRF (FG-IR-20-158)	14 Jan 202200:00	–	nessus
NCSC	Vulnerabilities fixed in FortiOS	8 Dec 202100:00	–	ncsc
NVD	CVE-2021-26103	8 Dec 202112:15	–	nvd
Prion	Cross site request forgery (csrf)	8 Dec 202112:15	–	prion

[
  {
    "product": "Fortinet FortiOS",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiOS 7.0.0, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.14, 6.0.13, 6.0.12, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.14, 5.6.13, 5.6.12, 5.6.11, 5.6.10, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.1, 5.6.0"
      }
    ]
  }
]

Source	Link
fortiguard	www.fortiguard.com/advisory/FG-IR-20-158

08 Dec 2021 12:01Current

9High risk

Vulners AI Score9

CVSS 3.16.3

EPSS0.00422