CVE-2021-42761
First published: Thu Feb 16 2023(Updated: )
A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiWeb | >=5.6.0<5.9.2 | |
| Fortinet FortiWeb | >=6.0.0<6.0.8 | |
| Fortinet FortiWeb | >=6.1.0<6.1.3 | |
| Fortinet FortiWeb | >=6.2.0<6.2.7 | |
| Fortinet FortiWeb | >=6.3.0<6.3.17 | |
| Fortinet FortiWeb | >=6.4.0<7.0.0 |
Remedy
Please upgrade to FortiWeb version 7.0.0 or above Please upgrade to FortiWeb version 6.3.17 or above Please upgrade to FortiWeb version 6.2.7 or above Please upgrade to FortiWeb version 6.1.3 or above Please upgrade to FortiWeb version 6.0.8 or above Please upgrade to FortiWeb version 5.9.2 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-42761?
CVE-2021-42761 is a session fixation vulnerability in FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1.
How severe is CVE-2021-42761?
CVE-2021-42761 has a severity rating of 9.8 (Critical).
What is the CWE-ID for CVE-2021-42761?
The CWE-ID for CVE-2021-42761 is CWE-384.
How can a remote attacker exploit CVE-2021-42761?
A remote, unauthenticated attacker may exploit CVE-2021-42761 to infer the session identifier and potentially hijack a user's session.
Is there a fix available for CVE-2021-42761?
Yes, Fortinet has released fixes for CVE-2021-42761. Please refer to the vendor's advisory for the appropriate patches and updates.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/author
- agent/severity
- agent/weakness
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/fortinet
- canonical/fortinet fortiweb
- version/fortinet fortiweb/5.6.0
- version/fortinet fortiweb/6.0.0
- version/fortinet fortiweb/6.1.0
- version/fortinet fortiweb/6.2.0
- version/fortinet fortiweb/6.3.0
- version/fortinet fortiweb/6.4.0