{"api_version":"1","generated_at":"2026-04-23T07:57:47+00:00","cve":"CVE-2021-43074","urls":{"html":"https://cve.report/CVE-2021-43074","api":"https://cve.report/api/cve/CVE-2021-43074.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-43074","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-43074"},"summary":{"title":"CVE-2021-43074","description":"An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter.","state":"PUBLIC","assigner":"psirt@fortinet.com","published_at":"2023-02-16 19:15:00","updated_at":"2023-11-07 03:39:00"},"problem_types":["CWE-347"],"metrics":[],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-21-126","name":"https://fortiguard.com/psirt/FG-IR-21-126","refsource":"MISC","tags":[],"title":"PSIRT Advisories | FortiGuard","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43074","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43074","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"43074","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fortinet","cpe5":"fortios","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"43074","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"fortinet","cpe5":"fortiproxy","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"43074","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fortinet","cpe5":"fortiswitch","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"43074","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"fortinet","cpe5":"fortiweb","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-43074","qid":"43984","title":"FortiOS Padding Oracle In Cookie Encryption Vulnerability (FG-IR-21-126)"},{"cve":"CVE-2021-43074","qid":"44035","title":"FortiOS Padding Oracle In Cookie Encryption Vulnerability (FG-IR-21-126) (Unauthenticated Check)"}]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2021-43074","ASSIGNER":"psirt@fortinet.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Information disclosure","cweId":"CWE-347"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Fortinet","product":{"product_data":[{"product_name":"FortiSwitch","version":{"version_data":[{"version_affected":"<=","version_name":"7.0.0","version_value":"7.0.3"},{"version_affected":"<=","version_name":"6.4.0","version_value":"6.4.10"},{"version_affected":"<=","version_name":"6.2.0","version_value":"6.2.7"},{"version_affected":"<=","version_name":"6.0.0","version_value":"6.0.7"}]}},{"product_name":"FortiWeb","version":{"version_data":[{"version_affected":"<=","version_name":"6.4.0","version_value":"6.4.2"},{"version_affected":"<=","version_name":"6.3.0","version_value":"6.3.16"},{"version_affected":"<=","version_name":"6.2.0","version_value":"6.2.7"},{"version_affected":"<=","version_name":"6.1.0","version_value":"6.1.3"},{"version_affected":"<=","version_name":"6.0.0","version_value":"6.0.8"}]}},{"product_name":"FortiProxy","version":{"version_data":[{"version_affected":"<=","version_name":"7.0.0","version_value":"7.0.1"},{"version_affected":"<=","version_name":"2.0.0","version_value":"2.0.7"},{"version_affected":"<=","version_name":"1.2.0","version_value":"1.2.13"},{"version_affected":"<=","version_name":"1.1.0","version_value":"1.1.6"},{"version_affected":"<=","version_name":"1.0.0","version_value":"1.0.7"}]}},{"product_name":"FortiOS","version":{"version_data":[{"version_affected":"<=","version_name":"7.0.0","version_value":"7.0.3"},{"version_affected":"<=","version_name":"6.4.0","version_value":"6.4.8"},{"version_affected":"<=","version_name":"6.2.0","version_value":"6.2.12"},{"version_affected":"<=","version_name":"6.0.0","version_value":"6.0.16"}]}}]}}]}},"references":{"reference_data":[{"url":"https://fortiguard.com/psirt/FG-IR-21-126","refsource":"MISC","name":"https://fortiguard.com/psirt/FG-IR-21-126"}]},"solution":[{"lang":"en","value":"Upgrade to FortiOS version 7.0.7 or above.\r\nUpgrade to FortiOS version 6.4.9 or above.\nUpgrade to FortiWeb version 7.0.0 or above.\r\nupgrade to FortiWeb version 6.3.17 or above.\nUpgrade to FortiProxy version 7.0.7 or above.\r\nUpgrade to FortiProxy version 2.0.8 or above.\nUpgrade to FortiSwitch version 7.2.0 or above.\r\nUpgrade to FortiSwitch version 7.0.4 or above.\r\nUpgrade to FortiSwitch version 6.4.11 or above."}],"impact":{"cvss":[{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C"}]}},"nvd":{"publishedDate":"2023-02-16 19:15:00","lastModifiedDate":"2023-11-07 03:39:00","problem_types":["CWE-347"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":1.4}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"2.0.8","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.4.11","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.4.9","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.0","versionEndExcluding":"7.0.0","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.3.17","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"43074","Ordinal":"219614","Title":"CVE-2021-43074","CVE":"CVE-2021-43074","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"43074","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}