Cryptographic Vulnerability in Fortinet Products Impacting User Credential Security
CVE-2021-32591

5.3MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortinet Fortisandbox
Vendor
CVE Published:
8 December 2021

Summary

A vulnerability exists in Fortinet products due to missing cryptographic steps in the function that encrypts user credentials for LDAP and RADIUS services. This oversight may enable attackers with access to the password store to compromise the confidentiality of sensitive information, thereby potentially exposing user data to unauthorized access. The affected versions include FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, and FortiMail 7.0.1 and earlier.

Affected Version(s)

Fortinet FortiSandbox FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier

References

https://fortiguard.com/advisory/FG-IR-20-222
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.