CVE-2021-36184

CWE-89 — SQL Injection4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.3%
top 46.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet FortiwlmFortinet Fortinet Fortiwlm
Timeline
PublishedNov 2
Latest updateMay 24

Description

A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclosure device, users and database information via crafted HTTP requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDfortinet/fortiwlm8.2.2 — 8.6.1
▶CVEListV5fortinet/fortinet_fortiwlmFortiWLM 8.6.1, 8.6.0, 8.5.2, 8.5.1, 8.5.0, 8.4.2, 8.4.1, 8.4.0, 8.3.2, 8.3.1, 8.3.0, 8.2.2

🔴Vulnerability Details

2
GHSA
GHSA-r3xp-qcg2-fr3f: A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8↗2022-05-24
▶
CVEList
CVE-2021-36184: A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8↗2021-11-02
▶

📋Vendor Advisories

1
Fortinet
A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8.6...↗2021-11-02
▶