Vulnerabilities > CVE-2021-36177 - Unspecified vulnerability in Fortinet Fortiauthenticator

CVSS 3.3 - LOW

Attack vector

ADJACENT_NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

low complexity

fortinet

NVD

Published: 2022-02-02

Updated: 2022-07-12

Summary

An improper access control vulnerability [CWE-284] in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may allow an attacker on the same vlan as the HA management interface to make an unauthenticated direct connection to the FAC's database.

Vulnerable Configurations

Part	Description	Count
Application	Fortinet Fortinet Fortiauthenticator 6.0.0 Fortinet Fortiauthenticator 6.0.1 Fortinet Fortiauthenticator 6.0.2 Fortinet Fortiauthenticator 6.0.3 Fortinet Fortiauthenticator 6.0.4 Fortinet Fortiauthenticator 6.0.5 Fortinet Fortiauthenticator 6.0.6 Fortinet Fortiauthenticator 6.0.7 Fortinet Fortiauthenticator 6.1.0 Fortinet Fortiauthenticator 6.1.1 Fortinet Fortiauthenticator 6.1.2 Fortinet Fortiauthenticator 6.2.0 Fortinet Fortiauthenticator 6.2.1 Fortinet Fortiauthenticator 6.3.0 Fortinet Fortiauthenticator 6.3.1 Fortinet Fortiauthenticator 6.3.2	16

References

https://fortiguard.com/psirt/FG-IR-20-217