CVE-2021-22128

7.1HIGH

Key Information:

Vendor
Fortinet
Status
Fortinet Fortiproxy
Vendor
CVE Published:
4 March 2021

Summary

An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote attacker to access internal service such as the ZebOS Shell on the FortiProxy appliance through the Quick Connection functionality.

Affected Version(s)

Fortinet FortiProxy FortiProxy 2.0.0, 1.2.9 and below

References

https://fortiguard.com/advisory/FG-IR-20-235
x_refsource_CONFIRM

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.