CVE-2021-41017

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.3.0 through 6.3.15 FortiWeb versions 6.4.0 through 6.4.1

Description Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb may allow a remote authenticated attacker to execute arbitrary code or commands via specifically crafted HTTP requests.

Recommendations For FortiWeb versions 6.3.0 through 6.3.15, update to a version that includes the fix for the heap-based buffer overflow vulnerabilities. For FortiWeb versions 6.4.0 through 6.4.1, update to a version that includes the fix for the heap-based buffer overflow vulnerabilities. As a temporary workaround, consider restricting access to the vulnerable web API controllers until a patch is available.