CVE-2021-42756: Buffer Overflow
First published: Thu Feb 16 2023(Updated: )
Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiWeb | >=5.6.0<6.0.8 | |
| Fortinet FortiWeb | >=6.1.0<6.1.3 | |
| Fortinet FortiWeb | >=6.2.0<6.2.7 | |
| Fortinet FortiWeb | >=6.3.0<6.3.17 | |
| Fortinet FortiWeb | >=6.4.0<=6.4.2 |
Remedy
Upgrade to FortiWeb 7.0.0 or above, Upgrade to FortiWeb 6.3.17 or above, Upgrade to FortiWeb 6.2.7 or above. Upgrade to FortiWeb 6.1.3 or above. Upgrade to FortiWeb 6.0.8 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-42756?
CVE-2021-42756 refers to multiple stack-based buffer overflow vulnerabilities in the proxy daemon of FortiWeb.
What is the severity of CVE-2021-42756?
CVE-2021-42756 has a severity score of 9.8, which is considered critical.
How can an attacker exploit CVE-2021-42756?
An unauthenticated remote attacker can achieve arbitrary code execution by exploiting the stack-based buffer overflow vulnerabilities in the proxy daemon of FortiWeb.
Which versions of FortiWeb are affected by CVE-2021-42756?
FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, and 6.4 all versions are affected by CVE-2021-42756.
Is there a patch available for CVE-2021-42756?
Yes, Fortinet has released patches to mitigate the vulnerabilities in FortiWeb. Please refer to the official Fortinet website for patch information.
- collector/nvd-index
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/author
- agent/severity
- agent/weakness
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/fortinet
- canonical/fortinet fortiweb
- version/fortinet fortiweb/5.6.0
- version/fortinet fortiweb/6.1.0
- version/fortinet fortiweb/6.2.0
- version/fortinet fortiweb/6.3.0
- version/fortinet fortiweb/6.4.0
- version/fortinet fortiweb/6.4.2