CVE-2021-36177
Medium
Description
An improper access control vulnerability [CWE-284] in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may allow an attacker on the same vlan as the HA management interface to make an unauthenticated direct connection to the FAC's database.
SeverityMedium
CVSS4.2
Exploit probability—
Product
Fortinet Fortiauthenticator
PublishedFeb 2, 2022
First seenFeb 2, 2022
How to fix
Update
- fortinet fortiauthenticator6.3.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortiauthenticator | 6.0.0 ≤ v < 6.3.3 | 6.3.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.