Information security specialists reported the finding of a critical information disclosure vulnerability in multiple Fortinet products, including FortiSandbox, FortiWeb and FortiADC.

Tracked as CVE-2021-3259, the flaw exists due to missing cryptographic steps in the function that encrypts users’ LDAP and RADIUS credentials. Malicious hackers in possession of the password store would be able to compromise the confidentiality of the encrypted secrets.

This is a medium severity vulnerability and received a 4.6/10 score according to the Common Vulnerability Scoring System (CVSS), as mentioned by information security experts.

The flaw resides in the following products and versions:

FortiSandbox: 3.2.0, 3.2.1, 3.2.2 & 4.0.0.

Fortinet FortiWeb: 5.7.0, 5.7.1, 5.7.2, 5.7.3, 5.8.0, 5.8.1, 5.8.2, 5.8.3, 5.8.5, 5.8.6, 5.8.7, 5.9.0, 5.9.1, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.1.0, 6.1.1, 6.1.2, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10 & 6.3.11

FortiADC: 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.1.7, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.3.7, 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 6.1.0, 6.1.1, 6.1.2, 6.1.3 & 6.2.0.

Even though there are no indications of active exploitation of this flaw, users of affected products are encouraged to update as soon as possible.

To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.

The post Information disclosure vulnerability in FortiSandbox, FortiWeb and FortiADC: Patch immediately appeared first on Information Security Newspaper | Hacking News.

source

You May Also Like

Critical remote code execution vulnerability in WinRAR demo version. Update quickly

A critical vulnerability in the trial version of WinRAR 5.70 would allow…

Zero-day vulnerability in FatPipe SD-WAN solutions allows uploading malicious files to affected servers

The Federal Bureau of Investigation (FBI) issued a statement warning about the…