CVE-2021-36171

8.1HIGH

Key Information:

Vendor
Fortinet
Status
Fortinet Fortiportal
Vendor
CVE Published:
1 March 2022

Summary

The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated attacker to predict parts of or the whole newly generated password within a given time frame.

Affected Version(s)

Fortinet FortiPortal FortiPortal before 6.0.6

References

https://fortiguard.com/psirt/FG-IR-21-099
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.