What is CVE-2021-32588?

CVE-2021-32588 is a critical-severity vulnerability in Fortinet Fortiportal, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2021-08-18.

How severe is CVE-2021-32588?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2021-32588 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Fortinet Fortiportal

CVE-2021-32588

A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may allow a remote and unauthenticated attacker to execute unauthorized commands as root by uploading and deploying malicious web application archive files using the default hard-coded Tomcat Manager username and password.

EPSS: 0.033 (87.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Fortinet Fortiportal — versions FortiPortal 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.3.5, 5.3.4, 5.3.3, 5.3.2, 5.3.1, 5.3.0, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1.2, 5.1.1, 5.1.0, 5.0.3, 5.0.2, 5.0.1, 5.0.0
Fortinet Fortiportal

Weakness classification (CWE)

CWE-798 — Use of Hard-coded Credentials

Public proof-of-concept exploits

References

psirt@fortinet.com (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2021-32588?: CVE-2021-32588 is a critical-severity vulnerability in Fortinet Fortiportal, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2021-08-18.
How severe is CVE-2021-32588?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2021-32588 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.