CVE-2021-42761

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-384

Affected software

VendorProductVersions
FortinetFortiWeb>= 6.4.0, <= 6.4.2; >= 6.3.0, <= 6.3.16; >= 6.2.0, <= 6.2.6; >= 6.1.0, <= 6.1.2; >= 6.0.0, <= 6.0.7; >= 5.9.0, <= 5.9.1; >= 5.8.5, <= 5.8.7; >= 5.8.0, <= 5.8.3; >= 5.7.0, <= 5.7.3; >= 5.6.0, <= 5.6.2

References

Timeline

Published
Feb 16, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-427625.3BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick hoCVE-2021-427637.5Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwCVE-2021-427649.1The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service (delayed consensus CVE-2021-427657.5The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to leverage network delay to cause a denial of sCVE-2021-427669.1The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service (long-range consensCVE-2021-427679.1A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and somCVE-2021-42775.3A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the fCVE-2021-427706.1A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication testCVE-2021-427717.8Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directoryCVE-2021-427729.8Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management moCVE-2021-427737.5Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management moCVE-2021-427749.8Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo
CVE-2021-42761: Critical severity, CVSS 9.8 | Vulnix