PT-2021-7462 · Fortinet · Fortimanager+1

Published 2021-08-03 · Updated 2021-08-12 · CVE-2021-32603

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiManager and FortiAnalyser GUI versions 7.0.0, 6.4.5 and below, 6.2.7 and below, 6.0.11 and below, 5.6.11 and below

Description A server-side request forgery (SSRF) vulnerability may allow a remote and authenticated attacker to access unauthorized files and services on the system via specifically crafted web requests. The vulnerability is related to insufficient checking of incoming requests, which can be exploited by a remote attacker to perform an SSRF attack by sending specially crafted requests.

Recommendations For FortiManager and FortiAnalyser GUI versions 7.0.0, 6.4.5 and below, 6.2.7 and below, 6.0.11 and below, 5.6.11 and below: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2022-06510

CVE-2021-32603

Affected Products

Fortianalyzer

Fortimanager

References · 6

• https://fortiguard.com/advisory/FG-IR-21-050 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06510 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-32603 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32603 · Vendor Advisory
• https://t.me/cvenotify/18677 · Telegram Post
• https://t.me/cibsecurity/26874 · Telegram Post