CVE-2021-42756
Last modified
CVE-2021-42756 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests.. EPSS estimates a 36.41% chance of exploitation in the next 30 days.
Description
Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortiweb | >= 5.6.0, < 6.0.8 |
| Fortinet | Fortiweb | >= 6.1.0, < 6.1.3 |
| Fortinet | Fortiweb | >= 6.2.0, < 6.2.7 |
| Fortinet | Fortiweb | >= 6.3.0, < 6.3.17 |
| Fortinet | Fortiweb | >= 6.4.0, <= 6.4.2 |
References
- https://fortiguard.com/psirt/FG-IR-21-186Vendor Advisory
- https://fortiguard.com/psirt/FG-IR-21-186Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-42756?
How severe is CVE-2021-42756?
How do I fix CVE-2021-42756?
Are you affected by CVE-2021-42756?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST