Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-36170

An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker to read the FortiCloud credentials which were used to activate the trial license in cleartext.

Published

2021-10-06T10:15:07.873

Last Modified

2024-11-21T06:13:14.913

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 3.2 (LOW)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

3.9

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-522
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application fortinet fortianalyzer < 6.4.7 Yes
Application fortinet fortianalyzer ≤ 7.0.1 Yes
Application fortinet fortimanager < 6.4.7 Yes
Application fortinet fortimanager < 7.0.1 Yes
References