Vulnerabilities > CVE-2021-36172 - XXE vulnerability in Fortinet Fortiportal

CVSS 8.1 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

fortinet

CWE-611

NVD

Published: 2021-11-02

Updated: 2021-11-04

Summary

An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of service or read arbitrary files from the underlying file system by means of specifically crafted XML documents.

Vulnerable Configurations

Part	Description	Count
Application	Fortinet Fortinet Fortiportal 5.1.0 Fortinet Fortiportal 5.1.1 Fortinet Fortiportal 5.1.2 Fortinet Fortiportal 5.0.0 Fortinet Fortiportal 5.0.1 Fortinet Fortiportal 5.0.2 Fortinet Fortiportal 5.0.3 Fortinet Fortiportal 4.2.0 Fortinet Fortiportal 4.2.1 Fortinet Fortiportal 4.2.2 Fortinet Fortiportal 4.2.3 Fortinet Fortiportal 4.2.4 Fortinet Fortiportal 4.1.0 Fortinet Fortiportal 4.1.1 Fortinet Fortiportal 4.1.2 Fortinet Fortiportal 4.0.0 Fortinet Fortiportal 4.0.1 Fortinet Fortiportal 4.0.2 Fortinet Fortiportal 4.0.3 Fortinet Fortiportal 4.0.4 Fortinet Fortiportal 5.2.0 Fortinet Fortiportal 5.2.1 Fortinet Fortiportal 5.2.2 Fortinet Fortiportal 5.2.3 Fortinet Fortiportal 5.2.4 Fortinet Fortiportal 5.2.5 Fortinet Fortiportal 6.0.0 Fortinet Fortiportal 6.0.1 Fortinet Fortiportal 6.0.2 Fortinet Fortiportal 6.0.3 Fortinet Fortiportal 6.0.4 Fortinet Fortiportal 6.0.5 Fortinet Fortiportal 5.3.0 Fortinet Fortiportal 5.3.1 Fortinet Fortiportal 5.3.2 Fortinet Fortiportal 5.3.3 Fortinet Fortiportal 5.3.4 Fortinet Fortiportal 5.3.5 Fortinet Fortiportal 5.3.6	39

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

References

https://fortiguard.com/advisory/FG-IR-21-104