CVE-2021-22128
Assigner: fortinet
Published: 2021-03-04T17:27:43
State: PUBLISHED
affected: product: Fortinet FortiProxy
vendor: Fortinet
versions: status: affected
version: FortiProxy 2.0.0, 1.2.9 and below
descriptions: value: An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote attacker to access internal service such as the ZebOS Shell on the FortiProxy appliance through the Quick Connection functionality.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
version: 3.1
problemTypes: descriptions: description: Improper Access Control
type: text