Weak Random Number Generation in FortiPortal by Fortinet
CVE-2021-36171

8.1HIGH

Key Information:

Vendor
Fortinet
Status
Fortinet Fortiportal
Vendor
CVE Published:
1 March 2022

Summary

The password reset functionality in FortiPortal prior to version 6.0.6 utilizes a cryptographically weak pseudo-random number generator. This vulnerability allows a remote, unauthenticated attacker to potentially predict the newly generated password or portions of it within a short timeframe, thereby compromising user accounts and system integrity.

Affected Version(s)

Fortinet FortiPortal FortiPortal before 6.0.6

References

https://fortiguard.com/psirt/FG-IR-21-099
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.