PT-2021-19797 · Fortinet · Fortimail+3

Published 2021-12-08 · Updated 2023-08-08 · CVE-2021-32591

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiSandbox versions prior to 4.0.1 FortiWeb versions prior to 6.3.12 FortiADC versions prior to 6.2.1 FortiMail versions 7.0.1 and earlier

Description A missing cryptographic steps issue in the function that encrypts users' LDAP and RADIUS credentials may allow an attacker with access to the password store to compromise the confidentiality of the encrypted secrets.

Recommendations For FortiSandbox versions prior to 4.0.1, update to version 4.0.1 or later. For FortiWeb versions prior to 6.3.12, update to version 6.3.12 or later. For FortiADC versions prior to 6.2.1, update to version 6.2.1 or later. For FortiMail versions 7.0.1 and earlier, update to a version later than 7.0.1.

Fix

Related Identifiers

CVE-2021-32591

Affected Products

Fortiadc

Fortimail

Fortisandbox

Fortiweb

References · 3

• https://osv.dev/vulnerability/CVE-2021-32591 · Vendor Advisory
• https://fortiguard.com/advisory/FG-IR-20-222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32591 · Security Note