CVE-2021-36191

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 6.4.1 and below Fortinet FortiWeb versions 6.3.15 and below

Description The issue allows an attacker to use the device as a proxy via crafted GET parameters in requests to error handlers, due to a url redirection to untrusted sites, also known as an 'open redirect'.

Recommendations For Fortinet FortiWeb versions 6.4.1 and below, update to a version above 6.4.1 to resolve the issue. For Fortinet FortiWeb versions 6.3.15 and below, update to a version above 6.3.15 to resolve the issue. As a temporary workaround, consider restricting access to error handlers to minimize the risk of exploitation.