CVE-2021-36170: Credentials observed in cleartext in the logfile
First published: Tue Oct 05 2021(Updated: )
An information disclosure vulnerability [CWE-200] in FortiAnalyzer and FortiManager VM may allow an authenticated attacker to read the FortiCloud credentials which were used to activate the trial license in cleartext.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiAnalyzer | <6.4.7 | |
| Fortinet FortiAnalyzer | >=7.0.0<=7.0.1 | |
| Fortinet FortiManager | <6.4.7 | |
| Fortinet FortiManager | >=7.0.0<7.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-36170?
CVE-2021-36170 is an information disclosure vulnerability in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below that may allow an authenticated attacker to read the FortiCloud credentials used to activate the trial license.
What is the severity of CVE-2021-36170?
The severity of CVE-2021-36170 is low, with a severity value of 3.2.
Which software versions are affected by CVE-2021-36170?
FortiAnalyzerVM versions up to and including 6.4.6, FortiAnalyzerVM versions 7.0.0 and 7.0.1, FortiManagerVM versions up to and including 6.4.6, and FortiManagerVM versions 7.0.0 and 7.0.1.
How can an attacker exploit CVE-2021-36170?
An authenticated attacker can exploit CVE-2021-36170 by reading the FortiCloud credentials in cleartext, which were used to activate the trial license.
Is there a fix for CVE-2021-36170?
Yes, updating to FortiAnalyzerVM version 6.4.7 or higher, or FortiAnalyzerVM version 7.0.1 or higher, and FortiManagerVM version 6.4.7 or higher, or FortiManagerVM version 7.0.1 or higher will fix CVE-2021-36170.
- collector/nvd-index
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2021-36170
- collector/fortiguard-psirt
- agent/references
- agent/severity
- agent/title
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- vendor/fortinet
- canonical/fortinet fortianalyzer
- version/fortinet fortianalyzer/7.0.0
- version/fortinet fortianalyzer/7.0.1
- canonical/fortinet fortimanager
- version/fortinet fortimanager/7.0.0