Description
A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote attacker to access at least the URL "/fpui/jsp/index.jsp" leading to unknown impact, presumably some violation of confidentiality. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA004.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FatPipe | WARP | 10.1 – < 10.1.2r60p91, 10.2 – < 10.2.2r42 | 10.1.2r60p91 |
| FatPipe | IPVPN | 10.1 – < 10.1.2r60p91, 10.2 – < 10.2.2r42 | 10.1.2r60p91 |
| FatPipe | MPVPN | 10.1 – < 10.1.2r60p91, 10.2 – < 10.2.2r42 | 10.1.2r60p91 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- FatPipe WARP/IPVPN/MPVPN - Authorization Bypass http/cves/2021/CVE-2021-27858.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.