PT-2021-5486 · Fortinet · Fortimanager+1

Published 2021-06-08 · Updated 2021-09-21 · CVE-2021-32587

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiManager versions 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below

Description An improper access control vulnerability in the GUI interface of FortiManager and FortiAnalyzer may allow a remote and authenticated attacker with a restricted user profile to retrieve the list of administrative users of other ADOMs and their related configuration.

Recommendations For FortiManager versions 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below, consider restricting access to the GUI interface until a patch is available. For FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below, consider restricting access to the GUI interface until a patch is available. As a temporary workaround, consider disabling the feature that allows retrieval of administrative users of other ADOMs and their related configuration until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2021-06335

CVE-2021-32587

Affected Products

Fortianalyzer

Fortimanager

References · 6

• https://bdu.fstec.ru/vul/2021-06335 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-32587 · Security Note
• https://fortiguard.com/advisory/FG-IR-21-059 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32587 · Vendor Advisory
• https://t.me/cibsecurity/26919 · Telegram Post
• https://t.me/cvenotify/19599 · Telegram Post