PT-2021-3821 · Apache+1 · Tomcat Manager+1
Published
2021-08-03
·
Updated
2021-08-26
·
CVE-2021-32588
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FortiPortal versions 5.0.x through 5.2.5
FortiPortal versions 5.1.x through 5.3.5
FortiPortal versions 6.0.0 through 6.0.4
Description
A use of hard-coded credentials vulnerability in FortiPortal may allow a remote and unauthenticated attacker to execute unauthorized commands as root by uploading and deploying malicious web application archive files using the default hard-coded Tomcat Manager
username and password. This issue is related to the use of hard-coded credentials, which can be exploited by a remote attacker to gain unauthorized access.Recommendations
For FortiPortal versions 5.0.x through 5.2.5, update to a version above 5.2.5 to resolve the issue.
For FortiPortal versions 5.1.x through 5.3.5, update to a version above 5.3.5 to resolve the issue.
For FortiPortal versions 6.0.0 through 6.0.4, update to a version above 6.0.4 to resolve the issue.
As a temporary workaround, consider disabling the default Tomcat Manager
username and password until a patch is available. Restrict access to the Tomcat Manager to minimize the risk of exploitation. Avoid using the default hard-coded credentials in the affected FortiPortal versions until the issue is resolved.Fix
Using Hardcoded Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fortiportal
Tomcat Manager