by Kastro
Paper/Archive/CVE-2021-36186

CVE-2021-36186

Fortinet Fortinet FortiWeb — A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute un…

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 76.0.760 × 2015.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests

Affected

ProductAffectedFixed inSource
Fortinet FortiWebFortiWeb 6.4.0, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.1, 6.3.0, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
fortinet (CNA)8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.com/advisory/FG-IR-21-119