Lucene search

FortinetCVE-2021-32588

HistoryAug 18, 2021 - 10:15 p.m.

CVE-2021-32588

2021-08-1822:15:06

CWE-798

fortinet

web.nvd.nist.gov

cve-2021-32588

fortiportal

cwe-798

remote attacker

unauthorized commands

root access

tomcat manager

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may allow a remote and unauthenticated attacker to execute unauthorized commands as root by uploading and deploying malicious web application archive files using the default hard-coded Tomcat Manager username and password.

Affected configurations

Nvd

Node

fortinetfortiportalRange5.0.0–5.0.3

fortinetfortiportalRange5.1.0–5.1.2

fortinetfortiportalRange5.2.0–5.2.5

fortinetfortiportalRange5.3.0–5.3.5

fortinetfortiportalRange6.0.0–6.0.4

VendorProductVersionCPE
fortinetfortiportal*cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiportal	*	cpe:2.3:a:fortinet:fortiportal::::::::

CNA Affected

[
  {
    "product": "Fortinet FortiPortal",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiPortal 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.3.5, 5.3.4, 5.3.3, 5.3.2, 5.3.1, 5.3.0, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1.2, 5.1.1, 5.1.0, 5.0.3, 5.0.2, 5.0.1, 5.0.0"
      }
    ]
  }
]

References

fortiguard.com/advisory/FG-IR-21-077

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

Related for CVE-2021-32588