SB2021111604 - Information disclosure in Fortinet FortiOS
Published: November 16, 2021
Security Bulletin ID
SB2021111604
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improper validation of certificate with host mismatch (CVE-ID: CVE-2021-41019)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper certificate validation with host mismatch when connecting to an LDAP server under attacker's control via options in GUI. A remote attacker can obtain AD credentials.
Remediation
Install update from vendor's website.