What is the severity of CVE-2021-42756?

CVE-2021-42756 has a severity score of 9.8, which is considered critical.

How can an attacker exploit CVE-2021-42756?

An unauthenticated remote attacker can achieve arbitrary code execution by exploiting the stack-based buffer overflow vulnerabilities in the proxy daemon of FortiWeb.

Which versions of FortiWeb are affected by CVE-2021-42756?

FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, and 6.4 all versions are affected by CVE-2021-42756.

Is there a patch available for CVE-2021-42756?

Yes, Fortinet has released patches to mitigate the vulnerabilities in FortiWeb. Please refer to the official Fortinet website for patch information.

Vulnerability/
CVE-2021-42756

critical

9.8

CWE

787 119 121

16/2/2023

4/8/2024

CVE-2021-42756: Buffer Overflow

Q: What is CVE-2021-42756?

CVE-2021-42756 refers to multiple stack-based buffer overflow vulnerabilities in the proxy daemon of FortiWeb.

First published: Thu Feb 16 2023(Updated: )

Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests.

Credit: psirt@fortinet.com

Affected Software	Affected Version	How to fix
Fortinet FortiWeb	>=5.6.0<6.0.8
Fortinet FortiWeb	>=6.1.0<6.1.3
Fortinet FortiWeb	>=6.2.0<6.2.7
Fortinet FortiWeb	>=6.3.0<6.3.17
Fortinet FortiWeb	>=6.4.0<=6.4.2

Remedy

Upgrade to FortiWeb 7.0.0 or above, Upgrade to FortiWeb 6.3.17 or above, Upgrade to FortiWeb 6.2.7 or above. Upgrade to FortiWeb 6.1.3 or above. Upgrade to FortiWeb 6.0.8 or above.

Never miss a vulnerability like this again

Reference Links

https://fortiguard.com/psirt/FG-IR-21-186

Frequently Asked Questions

What is CVE-2021-42756?
CVE-2021-42756 refers to multiple stack-based buffer overflow vulnerabilities in the proxy daemon of FortiWeb.
What is the severity of CVE-2021-42756?
CVE-2021-42756 has a severity score of 9.8, which is considered critical.
How can an attacker exploit CVE-2021-42756?
An unauthenticated remote attacker can achieve arbitrary code execution by exploiting the stack-based buffer overflow vulnerabilities in the proxy daemon of FortiWeb.
Which versions of FortiWeb are affected by CVE-2021-42756?
FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, and 6.4 all versions are affected by CVE-2021-42756.
Is there a patch available for CVE-2021-42756?
Yes, Fortinet has released patches to mitigate the vulnerabilities in FortiWeb. Please refer to the official Fortinet website for patch information.

collector/nvd-index
agent/softwarecombine
agent/type
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/references
agent/remedy
agent/author
agent/severity
agent/weakness
agent/tags
agent/first-publish-date
agent/description
agent/event
vendor/fortinet
canonical/fortinet fortiweb
version/fortinet fortiweb/5.6.0
version/fortinet fortiweb/6.1.0
version/fortinet fortiweb/6.2.0
version/fortinet fortiweb/6.3.0
version/fortinet fortiweb/6.4.0
version/fortinet fortiweb/6.4.2

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.