CVE-2021-32590: SQL Injection

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2021-32590.

Q: What is the severity of CVE-2021-32590?

The severity of CVE-2021-32590 is critical with a severity value of 8.8.

Q: What is the affected software?

The affected software is FortiPortal versions 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier.

Q: How can an attacker exploit this vulnerability?

An attacker with regular user's privileges can exploit this vulnerability to execute arbitrary commands on the underlying SQL database.

Q: How can I fix CVE-2021-32590?

To fix CVE-2021-32590, it is recommended to update to a patched version of FortiPortal.

Published Aug 4, 2021

Updated

Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow an attacker with regular user's privileges to execute arbitrary commands on the underlying SQL database via specifically crafted HTTP requests.

Affected Software

9 affected components

Fortinet FortiPortal>=3.2.0<=3.2.2

Fortinet FortiPortal>=4.0.0<=4.0.4

Fortinet FortiPortal>=4.1.0<=4.1.2

Fortinet FortiPortal>=4.2.0<=4.2.4

Fortinet FortiPortal>=5.0.0<=5.0.3

Fortinet FortiPortal>=5.1.0<=5.1.2

Fortinet FortiPortal>=5.2.0<5.2.6

Fortinet FortiPortal>=5.3.0<5.3.6

Fortinet FortiPortal>=6.0.0<6.0.5

Event History

Aug 4, 2021

CVE Published

via MITRE·01:31 PM

Data Sourced

via MITRE·01:31 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2021-32590.

What is the severity of CVE-2021-32590?

The severity of CVE-2021-32590 is critical with a severity value of 8.8.

What is the affected software?