CVE-2021-41017: Buffer Overflow
Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authenticated attacker to execute arbitrary code or commands via specifically crafted HTTP requests.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for these heap-based buffer overflow vulnerabilities?
The vulnerability ID for these heap-based buffer overflow vulnerabilities is CVE-2021-41017.
What is the affected software for these vulnerabilities?
The affected software for these vulnerabilities is FortiWeb versions 6.3.0 through 6.3.15, 6.4.0, and 6.4.1.
What is the severity of CVE-2021-41017?
The severity of CVE-2021-41017 is rated as high with a CVSS score of 8.8.
How can a remote authenticated attacker exploit these vulnerabilities?
A remote authenticated attacker can exploit these vulnerabilities by sending specifically crafted HTTP requests to the affected web API controllers.
Is there a fix or patch available for these vulnerabilities?
Yes, Fortinet has released patches and updates to address these vulnerabilities. It is recommended to update to the latest version of FortiWeb to mitigate the risk.