Name: CVE-2021-43206: Generation of Error Message Containing Sensitive Information
Creator: Rapid7
Published: 2022-05-04T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2021-43206, CWE-209, CVSS 4.3, EPSS 0.00391

A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0.0 through 7.0.1, 2.0.x allows malicious webservers to retrieve a web proxy's client username and IP via same origin HTTP requests triggering proxy-generated HTTP status codes pages.

CVSS Details

CVSS 3.1 Base Score: 4.3
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Fortinet Fortiproxy	—	Upgrade FortiProxy to 7.0.2Upgrade to the latest version of FortiProxy	Sep 30, 2026	May 3, 2022
Fortios	—	Upgrade FortiOS to 6.4.10Upgrade FortiOS to 7.0.4Upgrade to the latest version of FortiOSUpgrade FortiOS to 6.2.11	May 16, 2022	May 3, 2022

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence