CVE-2021-41027

A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, allows an authenticated attacker to execute unauthorized code or commands via crafted certificates loaded into the device.

CVSS v3 7.3 HIGH
CVSS v2.0 4.6 MEDIUM

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://fortiguard.com/advisory/FG-IR-21-134	Patch Vendor Advisory
https://fortiguard.com/advisory/FG-IR-21-134	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:fortiweb:6.4.0:::::::*
	cpe:2.3:a:fortinet:fortiweb:6.4.1:::::::*

History

21 Nov 2024, 06:25

Type	Values Removed	Values Added
References	~~() https://fortiguard.com/advisory/FG-IR-21-134 - Patch, Vendor Advisory~~	() https://fortiguard.com/advisory/FG-IR-21-134 - Patch, Vendor Advisory
CVSS	v2 : ~~4.6~~ v3 : ~~7.8~~	v2 : 4.6 v3 : 7.3

09 Dec 2021, 20:25

Type	Values Removed	Values Added
References	~~(CONFIRM) https://fortiguard.com/advisory/FG-IR-21-134 -~~	(CONFIRM) https://fortiguard.com/advisory/FG-IR-21-134 - Patch, Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 4.6 v3 : 7.8
CWE		CWE-787
CPE		cpe:2.3:a:fortinet:fortiweb:6.4.1:::::::* cpe:2.3:a:fortinet:fortiweb:6.4.0:::::::*

08 Dec 2021, 13:21

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-12-08 13:15

Updated : 2024-11-21 06:25

NVD link : CVE-2021-41027

Mitre link : CVE-2021-41027

CVE.ORG link : CVE-2021-41027

JSON object : View

Products Affected

fortinet

fortiweb

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2021-41027", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-12-08T13:15:08.013", "references": [{"url": "https://fortiguard.com/advisory/FG-IR-21-134", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@fortinet.com"}, {"url": "https://fortiguard.com/advisory/FG-IR-21-134", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, allows an authenticated attacker to execute unauthorized code or commands via crafted certificates loaded into the device."}, {"lang": "es", "value": "Un desbordamiento del b\u00fafer en la regi\u00f3n stack de la memoria en Fortinet FortiWeb versiones 6.4.1 y 6.4.0, permite a un atacante autenticado ejecutar c\u00f3digo o comandos no autorizados por medio de certificados dise\u00f1ados cargados en el dispositivo"}], "lastModified": "2024-11-21T06:25:18.017", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiweb:6.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74A92A08-E6F6-4522-A6DA-061950AD3525"}, {"criteria": "cpe:2.3:a:fortinet:fortiweb:6.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6A3D2C4-C3FA-4E12-9156-DAFEA4E00BCC"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}