CVE-2021-42761 Auth bypass in FortiWeb
Remote attackers can infer session identifiers to hijack user sessions in FortiWeb, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-42761?
CVE-2021-42761 is a high-severity authentication bypass vulnerability in Fortinet Fortiweb, published on 16 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session.
Weakness: CWE-384
Which versions are affected by CVE-2021-42761?
It affects 1 product.
Products include Fortinet Fortiweb.
How do I fix CVE-2021-42761?
No fix has been published for CVE-2021-42761 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-42761 being exploited?
There is no known exploitation of CVE-2021-42761 in the wild and no public exploit code.
Other vulnerabilities in Fortinet Fortiweb
Sources
Also known as GHSA-hxmr-8629-frhp.