Vulnerability Details : CVE-2021-43065
A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below allows attacker to gain higher privileges via the access to sensitive system data.
Products affected by CVE-2021-43065
- cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*
- cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*
- cpe:2.3:a:fortinet:fortinac:9.2.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-43065
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 15 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-43065
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | |
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
Fortinet, Inc. |
CWE ids for CVE-2021-43065
-
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-43065
-
https://github.com/orangecertcc/security-research/security/advisories/GHSA-8wx4-g5p9-348h
Fortinet FortiNAC - improper permissions set for tomcat users configuration file (CVE-2021-43065) · Advisory · orangecertcc/security-research · GitHubExploit;Third Party Advisory
-
https://fortiguard.com/advisory/FG-IR-21-178
PSIRT Advisories | FortiGuardVendor Advisory
Jump to