CVE-2021-43206: Fortinet FortiOS

Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days.

A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0.0 through 7.0.1, 2.0.x allows malicious webservers to retrieve a web proxy's client username and IP via same origin HTTP requests triggering proxy-generated HTTP status codes pages.

Affected products

• Fortinet FortiOS: from 5.6.0, before 6.0.14 (fixed in 6.0.14); from 6.2.0, before 6.2.10 (fixed in 6.2.10); from 6.4.0, before 6.4.8 (fixed in 6.4.8); from 7.0.0, before 7.0.4 (fixed in 7.0.4)
• Fortinet FortiProxy: from 2.0.0, before 2.0.9 (fixed in 2.0.9); from 7.0.0, before 7.0.2 (fixed in 7.0.2)

Published 2022-05-04. Last modified 2026-06-17.