Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2021-42761

A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiWeb

Default version status: unaffected

  • 6.4.0 to ≤ 6.4.2affected
  • 6.3.0 to ≤ 6.3.16affected
  • 6.2.0 to ≤ 6.2.6affected
  • 6.1.0 to ≤ 6.1.2affected
  • 6.0.0 to ≤ 6.0.7affected
  • 5.9.0 to ≤ 5.9.1affected
  • 5.8.5 to ≤ 5.8.7affected
  • 5.8.0 to ≤ 5.8.3affected
  • 5.7.0 to ≤ 5.7.3affected
  • 5.6.0 to ≤ 5.6.2affected

References