VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 18, 2021· Updated Oct 25, 2024

CVE-2021-32588

CVE-2021-32588

Description

A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may allow a remote and unauthenticated attacker to execute unauthorized commands as root by uploading and deploying malicious web application archive files using the default hard-coded Tomcat Manager username and password.

Affected products

2
  • Fortinet/Fortiportalllm-fuzzy2 versions
    <=6.0.4, <=5.3.5, <=5.2.5, 5.1.x, 5.0.x+ 1 more
    • (no CPE)range: <=6.0.4, <=5.3.5, <=5.2.5, 5.1.x, 5.0.x
    • (no CPE)range: FortiPortal 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.3.5, 5.3.4, 5.3.3, 5.3.2, 5.3.1, 5.3.0, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1.2, 5.1.1, 5.1.0, 5.0.3, 5.0.2, 5.0.1, 5.0.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.