CVE-2021-36194

Published: Dec 9, 2021Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted requests.

Affected (3)

Products: Fortinet: Fortiweb

Fortinet

1 product

Fortiweb

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiweb	From 6.3.0 to 6.3.15
Fortinet Fortiweb	Version 6.4.0
Fortinet Fortiweb	Version 6.4.1

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (2)

https://fortiguard.com/advisory/FG-IR-21-152

Source: psirt@fortinet.com

PatchVendor Advisory

https://fortiguard.com/advisory/FG-IR-21-152

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.