Sign-up

ID

VAR-202204-0961


CVE

CVE-2021-26114


TITLE

Fortinet FortiWAN SQL Injection Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2022-47981 // CNNVD: CNNVD-202204-2438

DESCRIPTION

Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. FortiWAN for, SQL There is an injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Fortinet FortiWan is a network device of Fortinet Corporation of the United States. Used to perform load balancing and fault tolerance across different networks. A SQL injection vulnerability exists in Fortinet FortiWAN versions prior to 4.5.9, which is caused by the program not properly filtering special elements used in SQL commands

Trust: 2.25

sources: NVD: CVE-2021-26114 // JVNDB: JVNDB-2022-009337 // CNVD: CNVD-2022-47981 // VULHUB: VHN-385078

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-47981

AFFECTED PRODUCTS

vendor:fortinetmodel:fortiwanscope:lteversion:4.5.8

Trust: 1.0

vendor:フォーティネットmodel:fortiwanscope:eqversion:4.5.9

Trust: 0.8

vendor:フォーティネットmodel:fortiwanscope:eqversion: -

Trust: 0.8

vendor:fortinetmodel:fortiwanscope:ltversion:4.5.9

Trust: 0.6

sources: CNVD: CNVD-2022-47981 // JVNDB: JVNDB-2022-009337 // NVD: CVE-2021-26114

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-26114
value: CRITICAL

Trust: 1.0

psirt@fortinet.com: CVE-2021-26114
value: CRITICAL

Trust: 1.0

NVD: CVE-2021-26114
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2022-47981
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202204-2438
value: CRITICAL

Trust: 0.6

VULHUB: VHN-385078
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-26114
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2022-47981
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-385078
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-26114
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 2.0

OTHER: JVNDB-2022-009337
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-47981 // VULHUB: VHN-385078 // JVNDB: JVNDB-2022-009337 // CNNVD: CNNVD-202204-2438 // NVD: CVE-2021-26114 // NVD: CVE-2021-26114

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.1

problemtype:SQL injection (CWE-89) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-385078 // JVNDB: JVNDB-2022-009337 // NVD: CVE-2021-26114

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202204-2438

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-202204-2438

PATCH

title:FG-IR-21-062url:https://www.fortiguard.com/psirt/FG-IR-21-062

Trust: 0.8

title:Patch for Fortinet FortiWAN SQL Injection Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/336021

Trust: 0.6

title:Fortinet FortiWan SQL Repair measures for injecting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=189251

Trust: 0.6

sources: CNVD: CNVD-2022-47981 // JVNDB: JVNDB-2022-009337 // CNNVD: CNNVD-202204-2438

EXTERNAL IDS

db:NVDid:CVE-2021-26114

Trust: 3.9

db:JVNDBid:JVNDB-2022-009337

Trust: 0.8

db:CNVDid:CNVD-2022-47981

Trust: 0.7

db:CS-HELPid:SB2022040534

Trust: 0.6

db:CNNVDid:CNNVD-202204-2438

Trust: 0.6

db:VULHUBid:VHN-385078

Trust: 0.1

sources: CNVD: CNVD-2022-47981 // VULHUB: VHN-385078 // JVNDB: JVNDB-2022-009337 // CNNVD: CNNVD-202204-2438 // NVD: CVE-2021-26114

REFERENCES

url:https://fortiguard.com/psirt/fg-ir-21-062

Trust: 1.7

url:https://cxsecurity.com/cveshow/cve-2021-26114/

Trust: 1.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-26114

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2022040534

Trust: 0.6

sources: CNVD: CNVD-2022-47981 // VULHUB: VHN-385078 // JVNDB: JVNDB-2022-009337 // CNNVD: CNNVD-202204-2438 // NVD: CVE-2021-26114

SOURCES

db:CNVDid:CNVD-2022-47981
db:VULHUBid:VHN-385078
db:JVNDBid:JVNDB-2022-009337
db:CNNVDid:CNNVD-202204-2438
db:NVDid:CVE-2021-26114

LAST UPDATE DATE

2024-08-14T14:10:52.545000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-47981date:2022-06-28T00:00:00
db:VULHUBid:VHN-385078date:2022-04-13T00:00:00
db:JVNDBid:JVNDB-2022-009337date:2023-08-04T04:53:00
db:CNNVDid:CNNVD-202204-2438date:2022-04-14T00:00:00
db:NVDid:CVE-2021-26114date:2022-04-13T18:51:58.070

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-47981date:2022-06-28T00:00:00
db:VULHUBid:VHN-385078date:2022-04-06T00:00:00
db:JVNDBid:JVNDB-2022-009337date:2023-08-04T00:00:00
db:CNNVDid:CNNVD-202204-2438date:2022-04-06T00:00:00
db:NVDid:CVE-2021-26114date:2022-04-06T10:15:07.933