CVE-2021-22124: Uncontrolled Resource Consumption (Denial of Service) in login module
First published: Tue Aug 03 2021(Updated: )
An uncontrolled resource consumption (denial of service) vulnerability in FortiSandbox and FortiAuthenticator login modules may allow an unauthenticated attacker to bring the device into an unresponsive state via specifically-crafted long request parameters.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiAuthenticator | >=4.0.0<=4.3.4 | |
| Fortinet FortiAuthenticator | >=5.0.0<=5.5.0 | |
| Fortinet FortiAuthenticator | >=6.0.0<6.0.6 | |
| Fortinet FortiSandbox | >=3.0.0<3.0.7 | |
| Fortinet FortiSandbox | >=3.1.0<3.1.5 | |
| Fortinet FortiSandbox | >=3.2.0<3.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this FortiSandbox and FortiAuthenticator vulnerability?
The vulnerability ID for this FortiSandbox and FortiAuthenticator vulnerability is CVE-2021-22124.
What is the severity of CVE-2021-22124?
The severity of CVE-2021-22124 is high with a severity value of 7.5.
What software versions are affected by CVE-2021-22124?
FortiSandbox versions 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6, as well as FortiAuthenticator versions before 6.0.6 are affected by CVE-2021-22124.
How does CVE-2021-22124 impact FortiSandbox and FortiAuthenticator?
CVE-2021-22124 can allow an unauthenticated attacker to bring the device into an unresponsive state through an uncontrolled resource consumption (denial of service) vulnerability in the login modules.
Is there a reference for CVE-2021-22124?
Yes, you can find more information about CVE-2021-22124 at the following reference: https://fortiguard.com/advisory/FG-IR-20-170
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2021-22124
- collector/fortiguard-psirt
- agent/title
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/fortinet
- canonical/fortinet fortiauthenticator
- version/fortinet fortiauthenticator/4.0.0
- version/fortinet fortiauthenticator/4.3.4
- version/fortinet fortiauthenticator/5.0.0
- version/fortinet fortiauthenticator/5.5.0
- version/fortinet fortiauthenticator/6.0.0
- canonical/fortinet fortisandbox
- version/fortinet fortisandbox/3.0.0
- version/fortinet fortisandbox/3.1.0
- version/fortinet fortisandbox/3.2.0