| IR Number | FG-IR-21-099 |
| Date | Mar 1, 2022 |
| Severity |
High |
| CVSSv3 Score | 7.4 |
| Impact | Unauthorized access |
| CVE ID | CVE-2021-36171 |
| Affected Products |
FortiPortal
:
6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.3.6, 5.3.5, 5.3.4, 5.3.3, 5.3.2, 5.3.1, 5.3.0, 5.2.6, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1.2, 5.1.1, 5.1.0, 5.0.3, 5.0.2, 5.0.1, 5.0.0, 4.2.2, 4.2.1, 4.1.2, 4.1.1, 4.1.0, 4.0.4, 4.0.3, 4.0.2, 4.0.1, 4.0.0
|
| CVRF | Download |
Refine Search
PSIRT Advisories
FortiPortal - Insecure password generation
Summary
The use of a cryptographically weak pseudo-random number generator (CWE-338) in the password reset feature of FortiPortal may allow a remote unauthenticated attacker to predict parts of or the whole newly generated password within a given time frame.
Affected Products
FortiPortal version 6.0.5 and below.
FortiPortal version 5.3.6 and below.
FortiPortal version 5.2.6 and below.
FortiPortal version 5.1.2 and below.
FortiPortal version 5.0.3 and below.
FortiPortal version 4.2.4 and below.
FortiPortal version 4.1.2 and below.
FortiPortal version 4.0.4 and below.
Solutions
Upgrade to FortiPortal version 6.0.6 or above.
Upgrade to FortiPortal version 5.3.7 or above.
Upgrade to FortiPortal version 5.2.7 or above.