4.1
Medium
CVE-2021-43074 An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and…
Description
An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiSwitch 7.0 | 7.0.0 → 7.0.3 | No fix stated |
| FortiSwitch 6.4 | 6.4.0 → 6.4.10 | No fix stated |
| FortiSwitch 6.2 | 6.2.0 → 6.2.7 | No fix stated |
| FortiSwitch 6.0 | 6.0.0 → 6.0.7 | No fix stated |
| FortiWeb 6.4 | 6.4.0 → 6.4.2 | No fix stated |
| FortiWeb 6.3 | 6.3.0 → 6.3.16 | No fix stated |
| FortiWeb 6.2 | 6.2.0 → 6.2.7 | No fix stated |
| FortiWeb 6.1 | 6.1.0 → 6.1.3 | No fix stated |
| FortiWeb 6.0 | 6.0.0 → 6.0.8 | No fix stated |
Show the 9 other branches Hide the 9 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiProxy 7.0 | 7.0.0 → 7.0.1 | No fix stated |
| FortiProxy 2.0 | 2.0.0 → 2.0.7 | No fix stated |
| FortiProxy 1.2 | 1.2.0 → 1.2.13 | No fix stated |
| FortiProxy 1.1 | 1.1.0 → 1.1.6 | No fix stated |
| FortiProxy 1.0 | 1.0.0 → 1.0.7 | No fix stated |
| FortiOS 7.0 | 7.0.0 → 7.0.3 | No fix stated |
| FortiOS 6.4 | 6.4.0 → 6.4.8 | No fix stated |
| FortiOS 6.2 | 6.2.0 → 6.2.12 | No fix stated |
| FortiOS 6.0 | 6.0.0 → 6.0.16 | No fix stated |
Other CVEs of FortiSwitch
The 9 CVEs of FortiSwitch →
CVE-2026-106175
A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions,…
2.1
Low
CVE-2024-48887
A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to…
9.3
Critical
CVE-2022-23439
A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison…
4.1
Medium
CVE-2023-37936
A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through…
9.6
Critical