CVE-2021-43067: Infoleak
A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows attacker to duplicate a target LDAP user 2 factors authentication token via crafted HTTP requests.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-43067?
CVE-2021-43067 is a vulnerability in Fortinet FortiAuthenticator that allows an unauthorized actor to duplicate a target LDAP user's 2-factor authentication token via crafted HTTP requests.
What versions of Fortinet FortiAuthenticator are affected by CVE-2021-43067?
Fortinet FortiAuthenticator versions 6.4.0, 6.3.2 and below, 6.2.1 and below, 6.1.2 and below, and 6.0.7 to 6.0.1 are affected by CVE-2021-43067.
What is the severity of CVE-2021-43067?
CVE-2021-43067 has a severity rating of 6.5 (high).
How can an attacker exploit CVE-2021-43067?
An attacker can exploit CVE-2021-43067 by sending crafted HTTP requests to duplicate a target LDAP user's 2-factor authentication token.
Is there a fix available for CVE-2021-43067?
Yes, Fortinet has released patches to address CVE-2021-43067. It is recommended to update to the latest version of Fortinet FortiAuthenticator.