CVE-2021-36170

LowCVSS 3.2/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker to read the FortiCloud credentials which were used to activate the trial license in cleartext.

Metrics

CVSS 3.1 3.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Oct 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-361718.1The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a rem CVE-2021-361728.1An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow CVE-2021-361738.8A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 th CVE-2021-361747.5A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an at CVE-2021-361755.4An improper neutralization of input vulnerability [CWE-79] in FortiWebManager versions 6.2.3 and below, 6.0.2 and below may allow a remote a CVE-2021-361766.1Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privilege CVE-2021-361774.3An improper access control vulnerability [CWE-284] in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may allow an attack CVE-2021-361786.5A insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below allows attacker to disclose third-party devices CVE-2021-361798.8A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below, 6.2.4 and below allows attacker to execute unauthorized code or CVE-2021-36187.4ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatib CVE-2021-361808.8Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and b CVE-2021-361813.1A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interfa