PT-2021-21173
CVE-2021-36191
·
تاريخ النشر
2021-12-08
·
تاريخ التحديث
2021-12-15
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Fortinet FortiWeb versions 6.4.1 and below
Fortinet FortiWeb versions 6.3.15 and below
Description
The issue allows an attacker to use the device as a proxy via crafted GET parameters in requests to error handlers, due to a url redirection to untrusted sites, also known as an 'open redirect'.
Recommendations
For Fortinet FortiWeb versions 6.4.1 and below, update to a version above 6.4.1 to resolve the issue.
For Fortinet FortiWeb versions 6.3.15 and below, update to a version above 6.3.15 to resolve the issue.
As a temporary workaround, consider restricting access to error handlers to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾