by Kastro
Paper/Archive/CVE-2021-32590

CVE-2021-32590

Fortinet Fortinet FortiPortal — Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 thr…

EPSS 2%CVSS 9.9
critical.is priorityof 100
45
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 76.6.766 × 2015.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow an attacker with regular user's privileges to execute arbitrary commands on the underlying SQL database via specifically crafted HTTP requests.

Affected

ProductAffectedFixed inSource
Fortinet FortiPortalFortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, 4.2.2 and earlier–CNA

Scores by source

fortinet (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.com/advisory/FG-IR-21-084