Sign-up

ID

VAR-202108-0655


CVE

CVE-2021-32597


TITLE

FortiManager  and  FortiAnalyser  Cross-site Scripting Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-009620

DESCRIPTION

Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and below user interface, may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious payload in GET parameters. FortiManager and FortiAnalyser Contains a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Both Fortinet FortiManager and Fortinet FortiAnalyzer are products of Fortinet. Fortinet FortiManager is a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can group devices into different management domains (ADOMs) to further simplify multi-device security deployment and management. Fortinet FortiAnalyzer is a centralized network security reporting solution. This product is mainly used to collect network log data, and analyze, report, and archive the security events, network traffic, and Web content in the logs through the report suite. FortiManager and FortiAnalyzer have a cross-site scripting vulnerability that stems from insufficient sanitization of user-supplied data in the FortiManager and FortiAnalyzer user interfaces. A remote attacker could exploit this vulnerability to trick a victim into clicking a specially crafted link on a vulnerable website and execute arbitrary HTML and script code in the user's browser. A disclosed vulnerability could allow a remote attacker to perform a cross-site scripting attack

Trust: 2.34

sources: NVD: CVE-2021-32597 // JVNDB: JVNDB-2021-009620 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-392569 // VULMON: CVE-2021-32597

AFFECTED PRODUCTS

vendor:fortinetmodel:fortimanagerscope:ltversion:6.4.6

Trust: 1.0

vendor:fortinetmodel:fortianalyzerscope:gteversion:6.4.0

Trust: 1.0

vendor:fortinetmodel:fortimanagerscope:gteversion:7.0.0

Trust: 1.0

vendor:fortinetmodel:fortimanagerscope:ltversion:6.2.8

Trust: 1.0

vendor:fortinetmodel:fortianalyzerscope:ltversion:6.4.6

Trust: 1.0

vendor:fortinetmodel:fortimanagerscope:gteversion:6.4.0

Trust: 1.0

vendor:fortinetmodel:fortimanagerscope:ltversion:7.0.1

Trust: 1.0

vendor:fortinetmodel:fortianalyzerscope:ltversion:6.2.8

Trust: 1.0

vendor:fortinetmodel:fortianalyzerscope:ltversion:7.0.1

Trust: 1.0

vendor:fortinetmodel:fortianalyzerscope:gteversion:7.0.0

Trust: 1.0

vendor:フォーティネットmodel:fortimanagerscope:eqversion:7.0.0

Trust: 0.8

vendor:フォーティネットmodel:fortimanagerscope:lteversion:6.2.7 and earlier

Trust: 0.8

vendor:フォーティネットmodel:fortimanagerscope:lteversion:6.4.5 and earlier

Trust: 0.8

vendor:フォーティネットmodel:fortianalyzerscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-009620 // NVD: CVE-2021-32597

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-32597
value: MEDIUM

Trust: 1.0

psirt@fortinet.com: CVE-2021-32597
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-32597
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202108-352
value: MEDIUM

Trust: 0.6

VULHUB: VHN-392569
value: LOW

Trust: 0.1

VULMON: CVE-2021-32597
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2021-32597
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-392569
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-32597
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 2.7
version: 3.1

Trust: 1.0

psirt@fortinet.com: CVE-2021-32597
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.1
impactScore: 2.5
version: 3.1

Trust: 1.0

NVD: CVE-2021-32597
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-392569 // VULMON: CVE-2021-32597 // JVNDB: JVNDB-2021-009620 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202108-352 // NVD: CVE-2021-32597 // NVD: CVE-2021-32597

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.1

problemtype:Cross-site scripting (CWE-79) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-392569 // JVNDB: JVNDB-2021-009620 // NVD: CVE-2021-32597

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202108-352

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:FG-IR-21-054url:https://www.fortiguard.com/psirt/FG-IR-21-054

Trust: 0.8

title:Fortinet FortiManager and Fortinet FortiAnalyzer Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=158601

Trust: 0.6

sources: JVNDB: JVNDB-2021-009620 // CNNVD: CNNVD-202108-352

EXTERNAL IDS

db:NVDid:CVE-2021-32597

Trust: 3.4

db:JVNDBid:JVNDB-2021-009620

Trust: 0.8

db:CNNVDid:CNNVD-202108-352

Trust: 0.7

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:AUSCERTid:ESB-2021.2617

Trust: 0.6

db:CS-HELPid:SB2021080318

Trust: 0.6

db:VULHUBid:VHN-392569

Trust: 0.1

db:VULMONid:CVE-2021-32597

Trust: 0.1

sources: VULHUB: VHN-392569 // VULMON: CVE-2021-32597 // JVNDB: JVNDB-2021-009620 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202108-352 // NVD: CVE-2021-32597

REFERENCES

url:https://fortiguard.com/advisory/fg-ir-21-054

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-32597

Trust: 1.4

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021080318

Trust: 0.6

url:https://vigilance.fr/vulnerability/fortianalyzer-fortimanager-cross-site-scripting-36041

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2617

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/79.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-392569 // VULMON: CVE-2021-32597 // JVNDB: JVNDB-2021-009620 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202108-352 // NVD: CVE-2021-32597

SOURCES

db:VULHUBid:VHN-392569
db:VULMONid:CVE-2021-32597
db:JVNDBid:JVNDB-2021-009620
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202108-352
db:NVDid:CVE-2021-32597

LAST UPDATE DATE

2024-08-14T13:01:51.735000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-392569date:2021-08-13T00:00:00
db:VULMONid:CVE-2021-32597date:2021-08-13T00:00:00
db:JVNDBid:JVNDB-2021-009620date:2022-05-13T08:37:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202108-352date:2021-08-24T00:00:00
db:NVDid:CVE-2021-32597date:2021-08-13T17:11:39.617

SOURCES RELEASE DATE

db:VULHUBid:VHN-392569date:2021-08-06T00:00:00
db:VULMONid:CVE-2021-32597date:2021-08-06T00:00:00
db:JVNDBid:JVNDB-2021-009620date:2022-05-13T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202108-352date:2021-08-03T00:00:00
db:NVDid:CVE-2021-32597date:2021-08-06T11:15:07.547