Vulnerability Details CVE-2021-36177
An improper access control vulnerability [CWE-284] in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may allow an attacker on the same vlan as the HA management interface to make an unauthenticated direct connection to the FAC's database.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 38.1%
CVSS Severity
CVSS v3 Score 4.2
CVSS v2 Score 3.3
Products affected by CVE-2021-36177
-
cpe:2.3:a:fortinet:fortiauthenticator:6.0.0
-
cpe:2.3:a:fortinet:fortiauthenticator:6.0.1
-
cpe:2.3:a:fortinet:fortiauthenticator:6.0.2
-
cpe:2.3:a:fortinet:fortiauthenticator:6.0.3
-
cpe:2.3:a:fortinet:fortiauthenticator:6.0.4
-
cpe:2.3:a:fortinet:fortiauthenticator:6.0.5
-
cpe:2.3:a:fortinet:fortiauthenticator:6.0.6
-
cpe:2.3:a:fortinet:fortiauthenticator:6.0.7
-
cpe:2.3:a:fortinet:fortiauthenticator:6.1.0
-
cpe:2.3:a:fortinet:fortiauthenticator:6.1.1
-
cpe:2.3:a:fortinet:fortiauthenticator:6.1.2
-
cpe:2.3:a:fortinet:fortiauthenticator:6.2.0
-
cpe:2.3:a:fortinet:fortiauthenticator:6.2.1
-
cpe:2.3:a:fortinet:fortiauthenticator:6.3.0
-
cpe:2.3:a:fortinet:fortiauthenticator:6.3.1
-
cpe:2.3:a:fortinet:fortiauthenticator:6.3.2