CVE-2021-41025
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an instance of concurrent execution using shared resource with improper synchronization and one of authentication bypass by capture-replay, may allow a remote unauthenticated attacker to circumvent the authentication process and authenticate as a legitimate cluster peer.
Múltiples vulnerabilidades en el mecanismo de autenticación de confd en las versiones 6.4.1, 6.4.0, 6.3.0 hasta 6.3.15, 6.2.0 hasta 6.2.6, 6.1.0 hasta 6.1.2, 6.0.0 hasta 6.0. 7, incluyendo una instancia de ejecución concurrente usando un recurso compartido con una sincronización no adecuada y una de omisión de autenticación por captura-repetición, puede permitir a un atacante remoto no autenticado omitir el proceso de autenticación y autenticarse como un peer legítimo del cluster
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2021-09-13 CVE Reserved
- 2021-12-08 CVE Published
- 2024-09-06 EPSS Updated
- 2024-10-25 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://fortiguard.com/advisory/FG-IR-21-130 | 2022-07-12 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Fortinet Search vendor "Fortinet" | Fortiweb Search vendor "Fortinet" for product "Fortiweb" | >= 6.0.0 <= 6.0.7 Search vendor "Fortinet" for product "Fortiweb" and version " >= 6.0.0 <= 6.0.7" | - |
Affected
| ||||||
Fortinet Search vendor "Fortinet" | Fortiweb Search vendor "Fortinet" for product "Fortiweb" | >= 6.2.0 <= 6.2.6 Search vendor "Fortinet" for product "Fortiweb" and version " >= 6.2.0 <= 6.2.6" | - |
Affected
| ||||||
Fortinet Search vendor "Fortinet" | Fortiweb Search vendor "Fortinet" for product "Fortiweb" | >= 6.3.0 <= 6.3.15 Search vendor "Fortinet" for product "Fortiweb" and version " >= 6.3.0 <= 6.3.15" | - |
Affected
| ||||||
Fortinet Search vendor "Fortinet" | Fortiweb Search vendor "Fortinet" for product "Fortiweb" | 6.1.0 Search vendor "Fortinet" for product "Fortiweb" and version "6.1.0" | - |
Affected
| ||||||
Fortinet Search vendor "Fortinet" | Fortiweb Search vendor "Fortinet" for product "Fortiweb" | 6.1.1 Search vendor "Fortinet" for product "Fortiweb" and version "6.1.1" | - |
Affected
| ||||||
Fortinet Search vendor "Fortinet" | Fortiweb Search vendor "Fortinet" for product "Fortiweb" | 6.1.2 Search vendor "Fortinet" for product "Fortiweb" and version "6.1.2" | - |
Affected
| ||||||
Fortinet Search vendor "Fortinet" | Fortiweb Search vendor "Fortinet" for product "Fortiweb" | 6.4.0 Search vendor "Fortinet" for product "Fortiweb" and version "6.4.0" | - |
Affected
| ||||||
Fortinet Search vendor "Fortinet" | Fortiweb Search vendor "Fortinet" for product "Fortiweb" | 6.4.1 Search vendor "Fortinet" for product "Fortiweb" and version "6.4.1" | - |
Affected
| ||||||
Fortinet Search vendor "Fortinet" | Fortiweb Search vendor "Fortinet" for product "Fortiweb" | 6.4.2 Search vendor "Fortinet" for product "Fortiweb" and version "6.4.2" | - |
Affected
|