Information security specialists reported the finding of a critical information disclosure vulnerability in multiple Fortinet products, including FortiSandbox, FortiWeb and FortiADC.

Tracked as CVE-2021-3259, the flaw exists due to missing cryptographic steps in the function that encrypts users’ LDAP and RADIUS credentials. Malicious hackers in possession of the password store would be able to compromise the confidentiality of the encrypted secrets.

This is a medium severity vulnerability and received a 4.6/10 score according to the Common Vulnerability Scoring System (CVSS), as mentioned by information security experts.

The flaw resides in the following products and versions:

FortiSandbox: 3.2.0, 3.2.1, 3.2.2 & 4.0.0.

Fortinet FortiWeb: 5.7.0, 5.7.1, 5.7.2, 5.7.3, 5.8.0, 5.8.1, 5.8.2, 5.8.3, 5.8.5, 5.8.6, 5.8.7, 5.9.0, 5.9.1, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.1.0, 6.1.1, 6.1.2, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10 & 6.3.11

FortiADC: 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.1.7, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.3.7, 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 6.1.0, 6.1.1, 6.1.2, 6.1.3 & 6.2.0.

Even though there are no indications of active exploitation of this flaw, users of affected products are encouraged to update as soon as possible.

To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.

The post Information disclosure vulnerability in FortiSandbox, FortiWeb and FortiADC: Patch immediately appeared first on Information Security Newspaper | Hacking News.

source

You May Also Like

Vulnerability in next-generation homomorphic encryption allows data to be stolen even while encrypted

Cybersecurity specialists report the detection of a critical vulnerability in homomorphic encryption,…

CVE-2021-3438 affects millions of HP printers worldwide. Update the firmware to fix it

HP security teams announced the fix of a critical vulnerability in a…