CVE-2021-43206

A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0.0 through 7.0.1, 2.0.x allows malicious webservers to retrieve a web proxy's client username and IP via same origin HTTP requests triggering proxy-generated HTTP status codes pages.
References
Link Resource
https://fortiguard.com/psirt/FG-IR-21-231 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

History

13 May 2022, 02:49

Type Values Removed Values Added
CPE cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
CWE CWE-209
CVSS v2 : unknown
v3 : unknown
v2 : 4.3
v3 : 4.3
First Time Fortinet
Fortinet fortiproxy
Fortinet fortios
References (CONFIRM) https://fortiguard.com/psirt/FG-IR-21-231 - (CONFIRM) https://fortiguard.com/psirt/FG-IR-21-231 - Vendor Advisory

04 May 2022, 16:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-05-04 16:15

Updated : 2023-12-10 14:22


NVD link : CVE-2021-43206

Mitre link : CVE-2021-43206

CVE.ORG link : CVE-2021-43206


JSON object : View

Products Affected

fortinet

  • fortios
  • fortiproxy
CWE
CWE-209

Generation of Error Message Containing Sensitive Information