PT-2021-7577 · Fortinet · Fortisandbox+1

Published 2021-08-03 · Updated 2021-08-12 · CVE-2021-22124

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 3.0.0 through 3.0.6 FortiSandbox versions 3.1.0 through 3.1.4 FortiSandbox versions 3.2.0 through 3.2.2 FortiAuthenticator versions prior to 6.0.6

Description The issue is related to an uncontrolled resource consumption, which may allow an unauthenticated attacker to bring the device into an unresponsive state via specifically-crafted long request parameters in the login modules. This can result in a denial of service.

Recommendations For FortiSandbox versions 3.0.0 through 3.0.6, update to a version outside of this range to resolve the issue. For FortiSandbox versions 3.1.0 through 3.1.4, update to a version outside of this range to resolve the issue. For FortiSandbox versions 3.2.0 through 3.2.2, update to a version outside of this range to resolve the issue. For FortiAuthenticator versions prior to 6.0.6, update to version 6.0.6 or later to resolve the issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2023-00108

CVE-2021-22124

Affected Products

Fortiauthenticator

Fortisandbox

References · 6

• https://osv.dev/vulnerability/CVE-2021-22124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22124 · Security Note
• https://bdu.fstec.ru/vul/2023-00108 · Security Note
• https://fortiguard.com/advisory/FG-IR-20-170 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-20-170 · Note
• https://t.me/cibsecurity/26851 · Telegram Post