CVE-2021-41030

published 2021-12-08

CVE-2021-41030: An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated…

critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I H A N

An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated attacker to impersonate an existing user by intercepting and re-using valid SAML authentication messages.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
fortinet	forticlient	—	—
fortinet	forticlient_enterprise_management_server	—	—
fortinet	forticlient_enterprise_management_server	—	—
fortinet	forticlient_enterprise_management_server	6.2.0 – 6.2.9	—
fortinet	forticlient_enterprise_management_server	6.4.0 – 6.4.4	—
fortinet	forticliententerprisemanagementserver	—	—
fortinet	fortinet_forticlientems	—	—

CWE-294