CVE-2021-32588

Name of the Vulnerable Software and Affected Versions FortiPortal versions 5.0.x through 5.2.5 FortiPortal versions 5.1.x through 5.3.5 FortiPortal versions 6.0.0 through 6.0.4

Description A use of hard-coded credentials vulnerability in FortiPortal may allow a remote and unauthenticated attacker to execute unauthorized commands as root by uploading and deploying malicious web application archive files using the default hard-coded Tomcat Manager username and password. This issue is related to the use of hard-coded credentials, which can be exploited by a remote attacker to gain unauthorized access.

Recommendations For FortiPortal versions 5.0.x through 5.2.5, update to a version above 5.2.5 to resolve the issue. For FortiPortal versions 5.1.x through 5.3.5, update to a version above 5.3.5 to resolve the issue. For FortiPortal versions 6.0.0 through 6.0.4, update to a version above 6.0.4 to resolve the issue. As a temporary workaround, consider disabling the default Tomcat Manager username and password until a patch is available. Restrict access to the Tomcat Manager to minimize the risk of exploitation. Avoid using the default hard-coded credentials in the affected FortiPortal versions until the issue is resolved.