Lucene search

[email protected]CVE-2021-32590

HistoryAug 04, 2021 - 2:15 p.m.

CVE-2021-32590

2021-08-0414:15:08

CWE-89

[email protected]

web.nvd.nist.gov

cve

2021

32590

sql

command

vulnerabilities

fortiportal

nvd

security

http

requests

database

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.4%

JSON

Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow an attacker with regular user’s privileges to execute arbitrary commands on the underlying SQL database via specifically crafted HTTP requests.

Affected configurations

NVD

Node

fortinetfortiportalRange3.2.0–3.2.2

fortinetfortiportalRange4.0.0–4.0.4

fortinetfortiportalRange4.1.0–4.1.2

fortinetfortiportalRange4.2.0–4.2.4

fortinetfortiportalRange5.0.0–5.0.3

fortinetfortiportalRange5.1.0–5.1.2

fortinetfortiportalRange5.2.0–5.2.6

fortinetfortiportalRange5.3.0–5.3.6

fortinetfortiportalRange6.0.0–6.0.5

CPENameOperatorVersion
fortinet:fortiportalfortinet fortiportalle3.2.2
fortinet:fortiportalfortinet fortiportalle4.0.4
fortinet:fortiportalfortinet fortiportalle4.1.2
fortinet:fortiportalfortinet fortiportalle4.2.4
fortinet:fortiportalfortinet fortiportalle5.0.3
fortinet:fortiportalfortinet fortiportalle5.1.2
fortinet:fortiportalfortinet fortiportallt5.2.6
fortinet:fortiportalfortinet fortiportallt5.3.6
fortinet:fortiportalfortinet fortiportallt6.0.5

CPE	Name	Operator	Version
fortinet:fortiportal	fortinet fortiportal	le	3.2.2
fortinet:fortiportal	fortinet fortiportal	le	4.0.4
fortinet:fortiportal	fortinet fortiportal	le	4.1.2
fortinet:fortiportal	fortinet fortiportal	le	4.2.4
fortinet:fortiportal	fortinet fortiportal	le	5.0.3
fortinet:fortiportal	fortinet fortiportal	le	5.1.2
fortinet:fortiportal	fortinet fortiportal	lt	5.2.6
fortinet:fortiportal	fortinet fortiportal	lt	5.3.6
fortinet:fortiportal	fortinet fortiportal	lt	6.0.5

CNA Affected

[
  {
    "product": "Fortinet FortiPortal",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, 4.2.2 and earlier"
      }
    ]
  }
]

References

fortiguard.com/advisory/FG-IR-21-084

Social References

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.4%

JSON

Related for CVE-2021-32590

prion1 nvd1 cnvd1 d0znpp1 fortinet1 cvelist1