Sign-up

ID

VAR-202202-1046


CVE

CVE-2021-36193


TITLE

FortiWeb  Out-of-bounds write vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-004758

DESCRIPTION

Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands. FortiWeb Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Fortinet FortiWeb is a web application layer firewall developed by Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, etc., to ensure the security of web applications and protect sensitive database content

Trust: 1.71

sources: NVD: CVE-2021-36193 // JVNDB: JVNDB-2022-004758 // VULHUB: VHN-398103

AFFECTED PRODUCTS

vendor:fortinetmodel:fortiwebscope:ltversion:6.3.16

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:6.3.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:ltversion:6.4.2

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:ltversion:6.2.6

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:6.4.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:5.0.0

Trust: 1.0

vendor:フォーティネットmodel:fortiwebscope:eqversion:6.4.2

Trust: 0.8

vendor:フォーティネットmodel:fortiwebscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-004758 // NVD: CVE-2021-36193

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-36193
value: HIGH

Trust: 1.0

psirt@fortinet.com: CVE-2021-36193
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-36193
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202202-132
value: MEDIUM

Trust: 0.6

VULHUB: VHN-398103
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-36193
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-398103
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-36193
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

psirt@fortinet.com: CVE-2021-36193
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-36193
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-398103 // JVNDB: JVNDB-2022-004758 // CNNVD: CNNVD-202202-132 // NVD: CVE-2021-36193 // NVD: CVE-2021-36193

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.1

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-398103 // JVNDB: JVNDB-2022-004758 // NVD: CVE-2021-36193

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202202-132

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202202-132

PATCH

title:FG-IR-21-132url:https://www.fortiguard.com/psirt/FG-IR-21-132

Trust: 0.8

title:Fortinet FortiWeb Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=183581

Trust: 0.6

sources: JVNDB: JVNDB-2022-004758 // CNNVD: CNNVD-202202-132

EXTERNAL IDS

db:NVDid:CVE-2021-36193

Trust: 3.3

db:JVNDBid:JVNDB-2022-004758

Trust: 0.8

db:CNNVDid:CNNVD-202202-132

Trust: 0.7

db:CNVDid:CNVD-2022-19074

Trust: 0.1

db:VULHUBid:VHN-398103

Trust: 0.1

sources: VULHUB: VHN-398103 // JVNDB: JVNDB-2022-004758 // CNNVD: CNNVD-202202-132 // NVD: CVE-2021-36193

REFERENCES

url:https://fortiguard.com/advisory/fg-ir-21-132

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-36193

Trust: 1.4

sources: VULHUB: VHN-398103 // JVNDB: JVNDB-2022-004758 // CNNVD: CNNVD-202202-132 // NVD: CVE-2021-36193

SOURCES

db:VULHUBid:VHN-398103
db:JVNDBid:JVNDB-2022-004758
db:CNNVDid:CNNVD-202202-132
db:NVDid:CVE-2021-36193

LAST UPDATE DATE

2024-08-14T14:31:21.301000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-398103date:2022-02-07T00:00:00
db:JVNDBid:JVNDB-2022-004758date:2023-05-01T07:30:00
db:CNNVDid:CNNVD-202202-132date:2022-03-10T00:00:00
db:NVDid:CVE-2021-36193date:2022-02-07T18:25:11.973

SOURCES RELEASE DATE

db:VULHUBid:VHN-398103date:2022-02-02T00:00:00
db:JVNDBid:JVNDB-2022-004758date:2023-05-01T00:00:00
db:CNNVDid:CNNVD-202202-132date:2022-02-02T00:00:00
db:NVDid:CVE-2021-36193date:2022-02-02T12:15:07.977