VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Dec 9, 2021· Updated Jun 17, 2026

CVE-2021-36167

CVE-2021-36167

Description

An improper authorization vulnerabiltiy [CWE-285] in FortiClient Windows versions 7.0.0 and 6.4.6 and below and 6.2.8 and below may allow an unauthenticated attacker to bypass the webfilter control via modifying the session-id paramater.

Affected products

5
  • Fortinet/Forticlient5 versions
    cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*+ 4 more
    • cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*range: >=6.4.0,<=6.4.6
    • cpe:2.3:a:fortinet:forticlient:6.2.7:*:*:*:*:windows:*:*
    • cpe:2.3:a:fortinet:forticlient:7.0.0:*:*:*:*:windows:*:*
    • (no CPE)range: 7.0.0 and 6.4.6 and below and 6.2.8 and below
    • (no CPE)range: FortiClientWindows 7.0.0, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.