CVE-2021-41019
An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the connection to a malicious LDAP server via options in GUI, leading to disclosure of sensitive information, such as AD credentials.
Published
2021-11-02T18:15:08.660
Last Modified
2024-11-21T06:25:16.613
Status
Modified
Source
[email protected]
Severity
CVSSv3.1: 3.5 (LOW)
CVSSv2 Vector
AV:N/AC:M/Au:N/C:P/I:N/A:N
- Access Vector: NETWORK
- Access Complexity: MEDIUM
- Authentication: NONE
- Confidentiality Impact: PARTIAL
- Integrity Impact: NONE
- Availability Impact: NONE
Exploitability Score
8.6
Impact Score
2.9
Weaknesses
Affected Vendors & Products
| Type |
Vendor |
Product |
Version/Range |
Vulnerable? |
| Operating System |
fortinet
|
fortios
|
≤ 6.4.6 |
Yes
|
References