Sensitive Information Exposure in Fortinet FortiAuthenticator
CVE-2021-43067

8.3HIGH

Key Information:

Vendor
Fortinet
Status
Fortinet Fortiauthenticator
Vendor
CVE Published:
8 December 2021

Summary

The vulnerability in Fortinet FortiAuthenticator allows unauthorized actors to access sensitive information by exploiting a flaw that permits the duplication of a target LDAP user’s two-factor authentication token. This is achieved through the use of crafted HTTP requests, impacting multiple versions including 6.4.0 and earlier. Organizations using affected versions should take immediate measures to secure their systems.

Affected Version(s)

Fortinet FortiAuthenticator FortiAuthenticator 6.4.0, 6.3.2, 6.3.1, 6.3.0, 6.2.1, 6.2.0, 6.1.2, 6.1.1, 6.1.0, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1

References

https://fortiguard.com/advisory/FG-IR-21-211
x_refsource_CONFIRM

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.