CVE-2021-32594: Malicious File Upload
First published: Wed Aug 04 2021(Updated: )
An unrestricted file upload vulnerability in the web interface of FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow a low-privileged user to potentially tamper with the underlying system's files via the upload of specifically crafted files.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiPortal | >=4.0.0<=4.0.4 | |
| Fortinet FortiPortal | >=4.1.0<=4.1.2 | |
| Fortinet FortiPortal | >=4.2.0<=4.2.4 | |
| Fortinet FortiPortal | >=5.0.0<=5.0.3 | |
| Fortinet FortiPortal | >=5.1.0<=5.1.2 | |
| Fortinet FortiPortal | >=5.2.0<5.2.6 | |
| Fortinet FortiPortal | >=5.3.0<5.3.6 | |
| Fortinet FortiPortal | >=6.0.0<6.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this unrestricted file upload vulnerability in FortiPortal?
The vulnerability ID is CVE-2021-32594.
Which versions of FortiPortal are affected by this vulnerability?
FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier are affected.
What is the severity of CVE-2021-32594?
The severity of CVE-2021-32594 is high with a CVSS score of 8.1.
How can a low-privileged user exploit this vulnerability?
A low-privileged user can exploit this vulnerability by uploading specially crafted files to tamper with the underlying system's files.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the FortiGuard advisory: https://fortiguard.com/advisory/FG-IR-21-092
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/fortinet
- canonical/fortinet fortiportal
- version/fortinet fortiportal/4.0.0
- version/fortinet fortiportal/4.0.4
- version/fortinet fortiportal/4.1.0
- version/fortinet fortiportal/4.1.2
- version/fortinet fortiportal/4.2.0
- version/fortinet fortiportal/4.2.4
- version/fortinet fortiportal/5.0.0
- version/fortinet fortiportal/5.0.3
- version/fortinet fortiportal/5.1.0
- version/fortinet fortiportal/5.1.2
- version/fortinet fortiportal/5.2.0
- version/fortinet fortiportal/5.3.0
- version/fortinet fortiportal/6.0.0