CVE-2021-32591

{"id": "CVE-2021-32591", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2021-12-08T12:15:07.737", "references": [{"url": "https://fortiguard.com/advisory/FG-IR-20-222", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets."}, {"lang": "es", "value": "Una vulnerabilidad de pasos criptogr\u00e1ficos faltantes en la funci\u00f3n que cifra las credenciales LDAP y RADIUS de los usuarios en FortiSandbox versiones anteriores a 4.0.1, FortiWeb versiones anteriores a 6.3.12, FortiADC versiones anteriores a 6.2.1, FortiMail 7.0.1 y anteriores puede permitir que un atacante en posesi\u00f3n del almac\u00e9n de contrase\u00f1as comprometa la confidencialidad de los secretos cifrados"}], "lastModified": "2023-08-08T14:22:24.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23AD5C87-6555-4936-A1B8-8229C1F53F72", "versionEndIncluding": "5.4.4", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B938B6E-915F-42F4-B602-0CDF63E1F9BA", "versionEndIncluding": "6.0.3", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B3575EF-BFB5-4E8C-ACC2-878CB403503D", "versionEndIncluding": "6.1.3", "versionStartIncluding": "6.1.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:6.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FCDF60B5-A0BE-41F6-A0D5-53526A7BBAE1"}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:6.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B42E0536-4831-4A6B-AC0B-C7AE3CDE3834"}, {"criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87F1A94F-C3C5-4F33-9BA3-70BC3ABED4C1"}, {"criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D00B438D-B50E-4F68-ABCC-5F76108492A6", "versionEndIncluding": "5.6.3", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F19CA06C-67C2-423E-8E65-4502A06EB667", "versionEndIncluding": "6.0.11", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72F6AEF1-C5BF-4A9A-A843-A152AA168085", "versionEndIncluding": "6.2.7", "versionStartIncluding": "6.2.0"}, {"criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07883AF7-1C60-43C9-8D98-CCF2B20C3B13", "versionEndIncluding": "6.4.5", "versionStartIncluding": "6.4.0"}, {"criteria": "cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15993051-6D79-4D59-B43D-EE3DA539AA18"}, {"criteria": "cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77F5A17F-E5C0-47EB-AB34-4084943C3143"}, {"criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A82C2CB9-6C03-4ADC-93AF-C5798EFA6246", "versionEndIncluding": "3.2.2", "versionStartIncluding": "3.2.0"}, {"criteria": "cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0260B512-77CA-4FE8-A039-D7B287A19BAA"}, {"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CAE0CA7-074F-43AD-B8F7-502596CBFF20", "versionEndIncluding": "5.7.3", "versionStartIncluding": "5.7.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2AB0971-D9B6-42A6-BB8B-9CEA66F6609A", "versionEndIncluding": "5.8.7", "versionStartIncluding": "5.8.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5931460-A0F1-4BED-ADEF-A48602EA747C", "versionEndIncluding": "6.0.7", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B028C2F-34F0-44D2-B6D7-A7024E82801F", "versionEndIncluding": "6.1.2", "versionStartIncluding": "6.1.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B97AB280-E267-4ED4-B3D8-ABEB65A3353A", "versionEndIncluding": "6.2.4", "versionStartIncluding": "6.2.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2C6405-1C59-4E4F-9999-B9E4A259340A", "versionEndIncluding": "6.3.11", "versionStartIncluding": "6.3.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiweb:5.9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E06648CF-D92B-4A29-8600-FFFFC84AA435"}, {"criteria": "cpe:2.3:a:fortinet:fortiweb:5.9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00331438-9892-4210-B85A-E88382018927"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}