SQL Injection Vulnerability in FortiPortal by Fortinet
CVE-2021-32590

9.9CRITICAL

Key Information:

Vendor
Fortinet
Status
Fortinet Fortiportal
Vendor
CVE Published:
4 August 2021

Summary

The FortiPortal product line is vulnerable to multiple SQL injection vulnerabilities that stem from improper handling of specially crafted SQL command components. These flaws affect versions 4.2.2 and earlier, allowing an authenticated user to execute arbitrary commands on the underlying SQL database. Attackers can exploit this issue by sending specially crafted HTTP requests that manipulate database queries, potentially compromising data integrity and confidentiality.

Affected Version(s)

Fortinet FortiPortal FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, 4.2.2 and earlier

References

https://fortiguard.com/advisory/FG-IR-21-084
x_refsource_CONFIRM

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.