Lucene search

FortinetCVELIST:CVE-2021-24012

HistoryJun 02, 2021 - 12:42 p.m.

CVE-2021-24012

2021-06-0212:42:19

fortinet

www.cve.org

vulnerability

fortigate

sslvpn

ldap

certificate authority

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

39.5%

JSON

An improper following of a certificate’s chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with any certificate that is signed by a trusted Certificate Authority.

CNA Affected

[
  {
    "product": "Fortinet FortiOS",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiOS 6.4.0 to 6.4.4"
      }
    ]
  }
]

References

fortiguard.com/advisory/FG-IR-21-018

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

39.5%

JSON

Related for CVELIST:CVE-2021-24012