CVE-2021-32588 Hardcoded credentials in Fortinet FortiPortal

Critical 9.8 Published 18 Aug 2021 Updated 25 Oct 2024

Remote attackers can execute unauthorized root commands by exploiting hard-coded Tomcat Manager credentials to upload malicious archives.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-32588?

CVE-2021-32588 is a critical vulnerability in Fortinet FortiPortal, published on 18 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may allow a remote and unauthenticated attacker to execute unauthorized commands as root by uploading and deploying malicious web application archive files using the default hard-coded Tomcat Manager username and password.

Weakness: CWE-798

Which versions are affected by CVE-2021-32588?

It affects 1 product.

Products include Fortinet Fortiportal.

How do I fix CVE-2021-32588?

No fix has been published for CVE-2021-32588 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-32588 being exploited?

There is no known exploitation of CVE-2021-32588 in the wild and no public exploit code.

Sources

Also known as GHSA-wwc6-cvf7-4mc4.