Information disclosure vulnerability in FortiSandbox, FortiWeb and FortiADC: Patch immediately

Information security specialists reported the finding of a critical information disclosure vulnerability in multiple Fortinet products, including FortiSandbox, FortiWeb and FortiADC.

Tracked as CVE-2021-3259, the flaw exists due to missing cryptographic steps in the function that encrypts users’ LDAP and RADIUS credentials. Malicious hackers in possession of the password store would be able to compromise the confidentiality of the encrypted secrets.

This is a medium severity vulnerability and received a 4.6/10 score according to the Common Vulnerability Scoring System (CVSS), as mentioned by information security experts.

The flaw resides in the following products and versions:

FortiSandbox: 3.2.0, 3.2.1, 3.2.2 & 4.0.0.

Fortinet FortiWeb: 5.7.0, 5.7.1, 5.7.2, 5.7.3, 5.8.0, 5.8.1, 5.8.2, 5.8.3, 5.8.5, 5.8.6, 5.8.7, 5.9.0, 5.9.1, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.1.0, 6.1.1, 6.1.2, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10 & 6.3.11

FortiADC: 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.1.7, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.3.7, 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 6.1.0, 6.1.1, 6.1.2, 6.1.3 & 6.2.0.

Even though there are no indications of active exploitation of this flaw, users of affected products are encouraged to update as soon as possible.

To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.