CVE-2021-36190

MEDIUM

FortiWeb <= 6.4.1 and <= 6.3.15 - Unauthenticated Proxy Bypass via Crafted HTTP Requests

Title source: llm
STIX 2.1

Description

A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts via crafted HTTP requests.

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_confirm
https://fortiguard.com/advisory/FG-IR-21-123

Scores

CVSS v3 5.5
EPSS 0.0049
EPSS Percentile 65.8%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

Status published
Products (6)
fortinet/fortiweb 6.1.0
fortinet/fortiweb 6.1.1
fortinet/fortiweb 6.1.2
fortinet/fortiweb 6.4.0
fortinet/fortiweb 6.4.1
fortinet/fortiweb 6.0.0 - 6.0.7
Published Dec 08, 2021
Tracked Since Feb 18, 2026