CVE-2021-41030

An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated…

Medium · published December 8, 2021

CVSS v3.1
5.4
EPSS
1%
Percentile
62.0
In the wild
Unconfirmed
What it is

An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated attacker to impersonate an existing user by intercepting and re-using valid SAML authentication messages.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00987 · 62.0th percentile
Published
2021-12-08T17:51Z
EPSS history
Timeline
  • 08 DEC 17:51Z
    An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated…
    cvelistv5