Medium severity · published Dec 8, 2021
CVE-2021-32591
A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before…
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fortiadc · Fortinet
5.0.0 through 5.4.4; 6.0.0 through 6.0.3; 6.1.0 through 6.1.3; 6.2.0; 6.2.1 · source: NVD
FO
Fortimail · Fortinet
5.0 through 5.6.3; 6.0.0 through 6.0.11; 6.2.0 through 6.2.7; 6.4.0 through 6.4.5; 7.0.0; 7.0.1 · source: NVD
FO
Fortisandbox · Fortinet
3.2.0 through 3.2.2; 4.0.0 · source: NVD
FO
Fortiweb · Fortinet
5.7.0 through 5.7.3; 5.8.0 through 5.8.7; 6.0.0 through 6.0.7; 6.1.0 through 6.1.2; 6.2.0 through 6.2.4; 6.3.0 through 6.3.11; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-32591
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-32591
Patch
https://fortiguard.com/advisory/FG-IR-20-222
More from Fortiadc
4.3
CVE-2018-13374
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
9.8
CVE-2022-38381
An improper handling of malformed request vulnerability [CWE-228] exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0…
9.1
CVE-2023-25603
A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized…
8.8
CVE-2023-26205
An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an…
8.8
CVE-2022-35849
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0…