CVE-2021-36177
First published: Wed Feb 02 2022(Updated: )
An improper access control vulnerability [CWE-284] in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may allow an attacker on the same vlan as the HA management interface to make an unauthenticated direct connection to the FAC's database.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiAuthenticator | >=6.0.0<6.3.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-36177?
CVE-2021-36177 is an improper access control vulnerability in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x.
How does CVE-2021-36177 affect FortiAuthenticator?
CVE-2021-36177 allows an attacker on the same VLAN as the HA management interface to make an unauthenticated direct connection to the FortiAuthenticator's database.
What is the severity of CVE-2021-36177?
CVE-2021-36177 has a severity level of medium.
How can I fix CVE-2021-36177?
To fix CVE-2021-36177, upgrade FortiAuthenticator to version 6.3.3 or apply the necessary patches provided by Fortinet.
Where can I find more information about CVE-2021-36177?
You can find more information about CVE-2021-36177 on the FortiGuard Advisory page: https://fortiguard.com/psirt/FG-IR-20-217
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/severity
- agent/author
- agent/references
- agent/event
- agent/tags
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/fortinet
- canonical/fortinet fortiauthenticator
- version/fortinet fortiauthenticator/6.0.0