cvelistv5 - CVE-2021-32584

CVE-2021-32584 (GCVE-0-2021-32584)

Vulnerability from cvelistv5 – Published: 2025-03-17 13:05 – Updated: 2025-03-17 13:37

Summary

An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, version 8.2.7 to 8.2.4, version 8.1.3 may allow an unauthenticated and remote attacker to access certain areas of the web management CGI functionality by just specifying the correct URL. The vulnerability applies only to limited CGI resources and might allow the unauthorized party to access configuration details.

Severity ?

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

CWE

CWE-284 - Improper access control

Assigner

fortinet

References

URL

Tags

https://fortiguard.fortinet.com/psirt/FG-IR-20-138

Impacted products

	Vendor	Product	Version
	Fortinet	FortiWLC	Affected: 8.6.0 Affected: 8.5.0 , ≤ 8.5.3 (semver) Affected: 8.4.4 , ≤ 8.4.8 (semver) Affected: 8.4.0 , ≤ 8.4.2 (semver) Affected: 8.3.0 , ≤ 8.3.3 (semver) Affected: 8.2.4 , ≤ 8.2.7 (semver) Affected: 8.1.3 cpe:2.3:a:fortinet:fortiwlc:8.6.0:::::::* cpe:2.3:a:fortinet:fortiwlc:8.5.3:::::::* cpe:2.3:a:fortinet:fortiwlc:8.5.2:::::::* cpe:2.3:a:fortinet:fortiwlc:8.5.1:::::::* cpe:2.3:a:fortinet:fortiwlc:8.5.0:::::::* cpe:2.3:a:fortinet:fortiwlc:8.4.8:::::::* cpe:2.3:a:fortinet:fortiwlc:8.4.7:::::::* cpe:2.3:a:fortinet:fortiwlc:8.4.6:::::::* cpe:2.3:a:fortinet:fortiwlc:8.4.5:::::::* cpe:2.3:a:fortinet:fortiwlc:8.4.4:::::::* cpe:2.3:a:fortinet:fortiwlc:8.4.2:::::::* cpe:2.3:a:fortinet:fortiwlc:8.4.1:::::::* cpe:2.3:a:fortinet:fortiwlc:8.4.0:::::::* cpe:2.3:a:fortinet:fortiwlc:8.3.3:::::::* cpe:2.3:a:fortinet:fortiwlc:8.3.2:::::::* cpe:2.3:a:fortinet:fortiwlc:8.3.1:::::::* cpe:2.3:a:fortinet:fortiwlc:8.3.0:::::::* cpe:2.3:a:fortinet:fortiwlc:8.2.7:::::::* cpe:2.3:a:fortinet:fortiwlc:8.2.6:::::::* cpe:2.3:a:fortinet:fortiwlc:8.2.5:::::::* cpe:2.3:a:fortinet:fortiwlc:8.2.4:::::::* cpe:2.3:a:fortinet:fortiwlc:8.1.3:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-32584",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-17T13:37:19.143586Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-17T13:37:26.791Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiwlc:8.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.5.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.5.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.5.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.5.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.3.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.3.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.3.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.3.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiwlc:8.1.3:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiWLC",
          "vendor": "Fortinet",
          "versions": [
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "lessThanOrEqual": "8.5.3",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.4.8",
              "status": "affected",
              "version": "8.4.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.3.3",
              "status": "affected",
              "version": "8.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.7",
              "status": "affected",
              "version": "8.2.4",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "8.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, version 8.2.7 to 8.2.4, version 8.1.3 may allow an unauthenticated and remote attacker to access certain areas of the web management CGI functionality by just specifying the correct URL.  The vulnerability applies only to limited CGI resources and might allow the unauthorized party to access configuration details."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper access control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-17T13:05:44.978Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-20-138",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-20-138"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Please upgrade to FortiWLC version 8.5.4 or above.\nPlease upgrade to FortiWLC version 8.6.1 or above."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2021-32584",
    "datePublished": "2025-03-17T13:05:44.978Z",
    "dateReserved": "2021-05-11T21:19:05.180Z",
    "dateUpdated": "2025-03-17T13:37:26.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-32584\",\"sourceIdentifier\":\"psirt@fortinet.com\",\"published\":\"2025-03-17T14:15:17.413\",\"lastModified\":\"2025-07-24T20:17:07.543\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, version 8.2.7 to 8.2.4, version 8.1.3 may allow an unauthenticated and remote attacker to access certain areas of the web management CGI functionality by just specifying the correct URL.  The vulnerability applies only to limited CGI resources and might allow the unauthorized party to access configuration details.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de control de acceso indebido (CWE-284) en FortiWLC versi\u00f3n 8.6.0, 8.5.3 y anteriores, 8.4.8 y anteriores, 8.3.3 y anteriores, 8.2.7 a 8.2.4 y 8.1.3 podr\u00eda permitir que un atacante remoto no autenticado acceda a ciertas \u00e1reas de la funcionalidad CGI de administraci\u00f3n web simplemente especificando la URL correcta. Esta vulnerabilidad afecta \u00fanicamente a recursos CGI limitados y podr\u00eda permitir que un tercero no autorizado acceda a los detalles de configuraci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@fortinet.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"psirt@fortinet.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiwlc:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.1.3\",\"versionEndExcluding\":\"8.5.4\",\"matchCriteriaId\":\"C028C542-3792-4AF1-9FDE-B03FD6D6EAF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiwlc:8.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"18D7B164-2D5E-427E-81F4-6BBDA51131DC\"}]}]}],\"references\":[{\"url\":\"https://fortiguard.fortinet.com/psirt/FG-IR-20-138\",\"source\":\"psirt@fortinet.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-32584\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-17T13:37:19.143586Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-17T13:37:22.823Z\"}}], \"cna\": {\"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:fortinet:fortiwlc:8.6.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.5.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.5.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.5.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.5.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.4.8:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.4.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.4.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.4.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.4.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.4.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.4.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.4.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.3.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.3.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.3.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.3.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.2.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.2.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.2.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.2.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiwlc:8.1.3:*:*:*:*:*:*:*\"], \"vendor\": \"Fortinet\", \"product\": \"FortiWLC\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.6.0\"}, {\"status\": \"affected\", \"version\": \"8.5.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.5.3\"}, {\"status\": \"affected\", \"version\": \"8.4.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.4.8\"}, {\"status\": \"affected\", \"version\": \"8.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.4.2\"}, {\"status\": \"affected\", \"version\": \"8.3.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.3.3\"}, {\"status\": \"affected\", \"version\": \"8.2.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.2.7\"}, {\"status\": \"affected\", \"version\": \"8.1.3\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Please upgrade to FortiWLC version 8.5.4 or above.\\nPlease upgrade to FortiWLC version 8.6.1 or above.\"}], \"references\": [{\"url\": \"https://fortiguard.fortinet.com/psirt/FG-IR-20-138\", \"name\": \"https://fortiguard.fortinet.com/psirt/FG-IR-20-138\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, version 8.2.7 to 8.2.4, version 8.1.3 may allow an unauthenticated and remote attacker to access certain areas of the web management CGI functionality by just specifying the correct URL.  The vulnerability applies only to limited CGI resources and might allow the unauthorized party to access configuration details.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"Improper access control\"}]}], \"providerMetadata\": {\"orgId\": \"6abe59d8-c742-4dff-8ce8-9b0ca1073da8\", \"shortName\": \"fortinet\", \"dateUpdated\": \"2025-03-17T13:05:44.978Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-32584\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-17T13:37:26.791Z\", \"dateReserved\": \"2021-05-11T21:19:05.180Z\", \"assignerOrgId\": \"6abe59d8-c742-4dff-8ce8-9b0ca1073da8\", \"datePublished\": \"2025-03-17T13:05:44.978Z\", \"assignerShortName\": \"fortinet\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GSD-2021-32584

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2021-32584

Aliases

CVE-2021-32584

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-32584",
    "id": "GSD-2021-32584"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-32584"
      ],
      "id": "GSD-2021-32584",
      "modified": "2023-12-13T01:23:08.939565Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2021-32584",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

FKIE_CVE-2021-32584

Vulnerability from fkie_nvd - Published: 2025-03-17 14:15 - Updated: 2025-07-24 20:17

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	psirt@fortinet.com	https://fortiguard.fortinet.com/psirt/FG-IR-20-138	Vendor Advisory

Impacted products

	Vendor	Product	Version
	fortinet	fortiwlc	*
	fortinet	fortiwlc	8.6.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C028C542-3792-4AF1-9FDE-B03FD6D6EAF8",
              "versionEndExcluding": "8.5.4",
              "versionStartIncluding": "8.1.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "18D7B164-2D5E-427E-81F4-6BBDA51131DC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, version 8.2.7 to 8.2.4, version 8.1.3 may allow an unauthenticated and remote attacker to access certain areas of the web management CGI functionality by just specifying the correct URL.  The vulnerability applies only to limited CGI resources and might allow the unauthorized party to access configuration details."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de control de acceso indebido (CWE-284) en FortiWLC versi\u00f3n 8.6.0, 8.5.3 y anteriores, 8.4.8 y anteriores, 8.3.3 y anteriores, 8.2.7 a 8.2.4 y 8.1.3 podr\u00eda permitir que un atacante remoto no autenticado acceda a ciertas \u00e1reas de la funcionalidad CGI de administraci\u00f3n web simplemente especificando la URL correcta. Esta vulnerabilidad afecta \u00fanicamente a recursos CGI limitados y podr\u00eda permitir que un tercero no autorizado acceda a los detalles de configuraci\u00f3n."
    }
  ],
  "id": "CVE-2021-32584",
  "lastModified": "2025-07-24T20:17:07.543",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-03-17T14:15:17.413",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-20-138"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "psirt@fortinet.com",
      "type": "Primary"
    }
  ]
}

CERTFR-2021-AVI-434

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Fortinet FortiWLC. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Fortinet	N/A	FortiWLC versions antérieures à 8.5.4
	Fortinet	N/A	FortiWLC versions antérieures à 8.6.1

References

Title

Publication Time

Tags

Bulletin de sécurité Fortinet du 03 juin 2021

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiWLC versions ant\u00e9rieures \u00e0 8.5.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWLC versions ant\u00e9rieures \u00e0 8.6.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-32584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-32584"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-434",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-06-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Fortinet FortiWLC. Elle permet \u00e0\nun attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Fortinet FortiWLC",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 03 juin 2021",
      "url": "https://www.fortiguard.com/psirt/FG-IR-20-138"
    }
  ]
}

CERTFR-2021-AVI-434

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Fortinet FortiWLC. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Fortinet	N/A	FortiWLC versions antérieures à 8.5.4
	Fortinet	N/A	FortiWLC versions antérieures à 8.6.1

References

Title

Publication Time

Tags

Bulletin de sécurité Fortinet du 03 juin 2021

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiWLC versions ant\u00e9rieures \u00e0 8.5.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWLC versions ant\u00e9rieures \u00e0 8.6.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-32584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-32584"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-434",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-06-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Fortinet FortiWLC. Elle permet \u00e0\nun attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Fortinet FortiWLC",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 03 juin 2021",
      "url": "https://www.fortiguard.com/psirt/FG-IR-20-138"
    }
  ]
}

GHSA-9CC9-H5MF-W5FR

Vulnerability from github – Published: 2025-03-17 15:31 – Updated: 2025-03-17 15:31

Details

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-32584"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-17T14:15:17Z",
    "severity": "MODERATE"
  },
  "details": "An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, version 8.2.7 to 8.2.4, version 8.1.3 may allow an unauthenticated and remote attacker to access certain areas of the web management CGI functionality by just specifying the correct URL.  The vulnerability applies only to limited CGI resources and might allow the unauthorized party to access configuration details.",
  "id": "GHSA-9cc9-h5mf-w5fr",
  "modified": "2025-03-17T15:31:48Z",
  "published": "2025-03-17T15:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32584"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-20-138"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2021-32584 (GCVE-0-2021-32584)

GSD-2021-32584

FKIE_CVE-2021-32584

CERTFR-2021-AVI-434

Solution

CERTFR-2021-AVI-434

Solution

GHSA-9CC9-H5MF-W5FR

Tags

Sightings

Nomenclature