First published: Tue Dec 07 2021(Updated: )
A relative path traversal [CWE-23] vulnerabiltiy in FortiOS and FortiProxy may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page.
Credit: psirt@fortinet.com
Affected Software | Affected Version | How to fix |
---|---|---|
Fortinet FortiProxy | =7.0.0 | |
Fortinet FortiOS | =7.0.0 | |
Fortinet FortiOS | =7.0.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for this Fortinet vulnerability is CVE-2021-41024.
The severity of CVE-2021-41024 is high.
FortiOS versions 7.0.0 and 7.0.1 and FortiProxy version 7.0.0 are affected by CVE-2021-41024.
The CWE ID for this vulnerability is CWE-23.
An unauthenticated, unauthorized attacker can exploit CVE-2021-41024 by injecting path traversal character sequences to disclose sensitive information of the server via the GET request of the login page.
Yes, Fortinet has released patches to fix the vulnerability. It is recommended to update to the latest version of FortiOS or FortiProxy.
More information about CVE-2021-41024 can be found at the FortiGuard Advisory FG-IR-21-181.