Medium severity4.3NVD Advisory· Published Nov 2, 2021· Updated Jun 17, 2026
CVE-2021-36172
CVE-2021-36172
Description
An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of service or read arbitrary files from the underlying file system by means of specifically crafted XML documents.
Affected products
3cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*range: >=4.0.0,<=4.0.4
- (no CPE)range: <6.0.6
- (no CPE)range: FortiPortal before 6.0.6
Patches
Vulnerability mechanics
References
1- fortiguard.com/advisory/FG-IR-21-104nvdVendor Advisory
News mentions
0No linked articles in our index yet.