Vulnerability · Published Mar 4, 2021 · Assigned by fortinet

CVE-2021-22128

High 7.1

In plain English

A high-severity security flaw in Fortinet FortiProxy from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)1.0%top 36.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote attacker to access internal service such as the ZebOS Shell on the FortiProxy appliance through the Quick Connection functionality.

Affected products (as reported)

Vendor	Product	Versions
Fortinet	Fortinet FortiProxy	FortiProxy 2.0.0, 1.2.9 and below

References

https://fortiguard.com/advisory/FG-IR-20-235 x_refsource_CONFIRM