CVE-2021-41030

Description

An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated attacker to impersonate an existing user by intercepting and re-using valid SAML authentication messages.

Reserved 2021-09-13 | Published 2021-12-08 | Updated 2024-10-25 | Assigner fortinet

Problem types

Escalation of privilege

Product status

FortiClientEMS 7.0.1, 7.0.0, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0
affected

References

fortiguard.com/advisory/FG-IR-21-192

cve.org (CVE-2021-41030)

nvd.nist.gov (CVE-2021-41030)

Download JSON