What is CVE-2021-36170?

CVE-2021-36170 is an information disclosure vulnerability in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below that may allow an authenticated attacker to read the FortiCloud credentials used to activate the trial license.

What is the severity of CVE-2021-36170?

The severity of CVE-2021-36170 is low, with a severity value of 3.2.

Which software versions are affected by CVE-2021-36170?

FortiAnalyzerVM versions up to and including 6.4.6, FortiAnalyzerVM versions 7.0.0 and 7.0.1, FortiManagerVM versions up to and including 6.4.6, and FortiManagerVM versions 7.0.0 and 7.0.1.

How can an attacker exploit CVE-2021-36170?

An authenticated attacker can exploit CVE-2021-36170 by reading the FortiCloud credentials in cleartext, which were used to activate the trial license.

Is there a fix for CVE-2021-36170?

Yes, updating to FortiAnalyzerVM version 6.4.7 or higher, or FortiAnalyzerVM version 7.0.1 or higher, and FortiManagerVM version 6.4.7 or higher, or FortiManagerVM version 7.0.1 or higher will fix CVE-2021-36170.

Vulnerability/
CVE-2021-36170

low

3.2

CWE

522

6/10/2021

4/8/2024

CVE-2021-36170

First published: Wed Oct 06 2021(Updated: )

An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker to read the FortiCloud credentials which were used to activate the trial license in cleartext.

Credit: psirt@fortinet.com

Affected Software	Affected Version	How to fix
Fortinet FortiAnalyzer	<6.4.7
Fortinet FortiAnalyzer	>=7.0.0<=7.0.1
Fortinet FortiManager	<6.4.7
Fortinet FortiManager	>=7.0.0<7.0.1

Never miss a vulnerability like this again

Reference Links

https://fortiguard.com/advisory/FG-IR-21-112

Frequently Asked Questions

What is CVE-2021-36170?
CVE-2021-36170 is an information disclosure vulnerability in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below that may allow an authenticated attacker to read the FortiCloud credentials used to activate the trial license.
What is the severity of CVE-2021-36170?
The severity of CVE-2021-36170 is low, with a severity value of 3.2.
Which software versions are affected by CVE-2021-36170?
FortiAnalyzerVM versions up to and including 6.4.6, FortiAnalyzerVM versions 7.0.0 and 7.0.1, FortiManagerVM versions up to and including 6.4.6, and FortiManagerVM versions 7.0.0 and 7.0.1.
How can an attacker exploit CVE-2021-36170?
An authenticated attacker can exploit CVE-2021-36170 by reading the FortiCloud credentials in cleartext, which were used to activate the trial license.
Is there a fix for CVE-2021-36170?
Yes, updating to FortiAnalyzerVM version 6.4.7 or higher, or FortiAnalyzerVM version 7.0.1 or higher, and FortiManagerVM version 6.4.7 or higher, or FortiManagerVM version 7.0.1 or higher will fix CVE-2021-36170.

collector/nvd-index
agent/author
agent/references
agent/last-modified-date
agent/softwarecombine
agent/first-publish-date
agent/description
agent/severity
agent/event
agent/tags
agent/type
agent/weakness
collector/mitre-cve
source/MITRE
vendor/fortinet
canonical/fortinet fortianalyzer
version/fortinet fortianalyzer/7.0.0
version/fortinet fortianalyzer/7.0.1
canonical/fortinet fortimanager
version/fortinet fortimanager/7.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.