PT-2021-7567 · Fortinet · Fortiportal

Published 2021-08-03 · Updated 2021-08-14 · CVE-2021-36168

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiPortal versions 5.3.x through 5.3.5 Fortinet FortiPortal versions 6.0.0 through 6.0.4 Fortinet FortiPortal versions prior to 6.2.5

Description The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability. This allows an authenticated attacker to disclose information via a crafted GET request with malicious parameter values.

Recommendations For Fortinet FortiPortal versions 5.3.x through 5.3.5, update to version 5.3.6 or later. For Fortinet FortiPortal versions 6.0.0 through 6.0.4, update to version 6.0.5 or later. For Fortinet FortiPortal versions prior to 6.2.5, update to version 6.2.5 or later. As a temporary workaround, consider restricting access to the vulnerable GET request endpoint until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-00089

CVE-2021-36168

Affected Products

Fortiportal

References · 8

• https://fortiguard.com/advisory/FG-IR-21-085 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00089 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-36168 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36168 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/4061 · Telegram Post
• https://t.me/cibsecurity/26814 · Telegram Post
• https://t.me/cvenotify/18642 · Telegram Post
• https://fortiguard.com/psirt/FG-IR-21-085 · Note