Lucene search

[email protected]CVE-2021-44166

HistoryMar 02, 2022 - 10:15 a.m.

CVE-2021-44166

2022-03-0210:15:07

[email protected]

web.nvd.nist.gov

cve-2021-44166

improper access control

fortitoken mobile

android

external push notification

cwe-284

nvd

2fa procedure

remote attacker

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

4.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.0%

JSON

An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a user’s password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user.

Affected configurations

NVD

Node

fortinetfortitoken_mobileMatch4.0.0android

fortinetfortitoken_mobileMatch4.0.1android

fortinetfortitoken_mobileMatch4.1.1android

fortinetfortitoken_mobileMatch4.2.1android

fortinetfortitoken_mobileMatch4.2.2android

fortinetfortitoken_mobileMatch4.3.0android

fortinetfortitoken_mobileMatch4.4.0android

fortinetfortitoken_mobileMatch4.5.0android

fortinetfortitoken_mobileMatch5.0.2android

fortinetfortitoken_mobileMatch5.0.3android

fortinetfortitoken_mobileMatch5.1.0android

CPENameOperatorVersion
fortinet:fortitoken_mobilefortinet fortitoken mobileeq4.0.0
fortinet:fortitoken_mobilefortinet fortitoken mobileeq4.0.1
fortinet:fortitoken_mobilefortinet fortitoken mobileeq4.1.1
fortinet:fortitoken_mobilefortinet fortitoken mobileeq4.2.1
fortinet:fortitoken_mobilefortinet fortitoken mobileeq4.2.2
fortinet:fortitoken_mobilefortinet fortitoken mobileeq4.3.0
fortinet:fortitoken_mobilefortinet fortitoken mobileeq4.4.0
fortinet:fortitoken_mobilefortinet fortitoken mobileeq4.5.0
fortinet:fortitoken_mobilefortinet fortitoken mobileeq5.0.2
fortinet:fortitoken_mobilefortinet fortitoken mobileeq5.0.3

CPE	Name	Operator	Version
fortinet:fortitoken_mobile	fortinet fortitoken mobile	eq	4.0.0
fortinet:fortitoken_mobile	fortinet fortitoken mobile	eq	4.0.1
fortinet:fortitoken_mobile	fortinet fortitoken mobile	eq	4.1.1
fortinet:fortitoken_mobile	fortinet fortitoken mobile	eq	4.2.1
fortinet:fortitoken_mobile	fortinet fortitoken mobile	eq	4.2.2
fortinet:fortitoken_mobile	fortinet fortitoken mobile	eq	4.3.0
fortinet:fortitoken_mobile	fortinet fortitoken mobile	eq	4.4.0
fortinet:fortitoken_mobile	fortinet fortitoken mobile	eq	4.5.0
fortinet:fortitoken_mobile	fortinet fortitoken mobile	eq	5.0.2
fortinet:fortitoken_mobile	fortinet fortitoken mobile	eq	5.0.3

Rows per page:

1-10 of 111

CNA Affected

[
  {
    "product": "Fortinet FortiTokenAndroid",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiTokenAndroid 5.1.0 and below"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-21-210

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

4.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.0%

JSON

Related for CVE-2021-44166

nvd1 prion1 cvelist1 fortinet1