FortiPortal - Insecure password generation

2022-03-0100:00:00

FortiGuard Labs

www.fortiguard.com

0.003 Low

EPSS

Percentile

70.5%

JSON

The use of a cryptographically weak pseudo-random number generator (CWE-338) in the password reset feature of FortiPortal may allow a remote unauthenticated attacker to predict parts of or the whole newly generated password within a given time frame.

CPENameOperatorVersion
fortiportaleq6.0.5
fortiportaleq6.0.4
fortiportaleq6.0.3
fortiportaleq6.0.2
fortiportaleq6.0.1
fortiportaleq6.0.0
fortiportaleq5.3.6
fortiportaleq5.3.5
fortiportaleq5.3.4
fortiportaleq5.3.3

Name	Operator	Version
fortiportal	eq	6.0.5
fortiportal	eq	6.0.4
fortiportal	eq	6.0.3
fortiportal	eq	6.0.2
fortiportal	eq	6.0.1
fortiportal	eq	6.0.0
fortiportal	eq	5.3.6
fortiportal	eq	5.3.5
fortiportal	eq	5.3.4
fortiportal	eq	5.3.3

Rows per page:

1-10 of 371

0.003 Low

EPSS

Percentile

70.5%

JSON

Related for FG-IR-21-099