{"id":"CVE-2021-41013","aliases":["EUVD-2021-28166","GHSA-78rc-hmp8-p646"],"status":"published","title":"An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3...","description":"An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log \u0026 Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00972,"percentile":0.62261,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2021-12-08T13:33:58Z","modified":"2026-06-17T04:07:44Z","products":[{"vendor":"fortinet","product":"fortinet fortiweb"},{"vendor":"fortinet","product":"fortiweb"}],"references":[{"url":"https://fortiguard.com/advisory/FG-IR-21-138","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41013"},{"url":"https://github.com/advisories/GHSA-78rc-hmp8-p646"}],"sources":{"cve":[{"id":"CVE-2021-41013","description":"An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log \u0026 Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs.","status":"published","published":"2021-12-08T13:33:58Z","modified":"2024-10-25T13:39:22.915Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:32:59.105382Z"}],"euvd":[{"id":"EUVD-2021-28166","description":"An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log \u0026 Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs.","status":"published","published":"2021-12-08T13:33:58Z","modified":"2024-10-25T13:39:22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C","level":"medium"}],"updated_at":"2026-11-03T00:05:19.027476Z"}],"ghsa":[{"id":"GHSA-78rc-hmp8-p646","title":"An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3...","description":"An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log \u0026 Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs.","status":"published","published":"2021-12-09T00:00:38Z","modified":"2023-02-01T05:06:42Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:50:24.014737Z"}],"nvd":[{"id":"CVE-2021-41013","description":"An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log \u0026 Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs.","status":"published","published":"2021-12-08T17:15:10.987Z","modified":"2026-06-17T04:07:44.6Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:01.811115Z"}]}}