Race Condition in FortiPortal Customer Database Interface
CVE-2021-36181

3.1LOW

Key Information:

Vendor
Fortinet
Status
Fortinet Fortiportal
Vendor
CVE Published:
2 November 2021

Summary

A race condition vulnerability within the customer database interface of FortiPortal prior to version 6.0.6 could allow an authenticated user with low privileges to execute specific web requests that lead to an inconsistent state of the underlying database. This issue occurs due to improper synchronization when executing concurrent tasks that share resources. It highlights the risks associated with database security and the importance of robust access controls.

Affected Version(s)

Fortinet FortiPortal FortiPortal before 6.0.6

References

https://fortiguard.com/advisory/FG-IR-21-102
x_refsource_CONFIRM

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.