{"id":"CVE-2021-42760","state":"PUBLISHED","title":"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive informatio","description":"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests.","publishedAt":"2021-12-08T11:31:41.000Z","updatedAt":"2024-10-25T13:41:54.810Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet Fortinet FortiWLM"],"affected":[{"vendor":"Fortinet","product":"Fortinet FortiWLM","versions":[{"version":"FortiWLM 8.6.1, 8.6.0, 8.5.2, 8.5.1, 8.5.0, 8.4.2, 8.4.1, 8.4.0, 8.3.2, 8.3.1, 8.3.0, 8.2.2","status":"affected"}]}],"references":["https://fortiguard.com/advisory/FG-IR-21-129"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:04.473Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/42xxx/CVE-2021-42760.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-42760","state":"PUBLISHED","datePublished":"2021-12-08T11:31:41.000Z","dateUpdated":"2024-10-25T13:41:54.810Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2021-10-20T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests."}],"affected":[{"vendor":"Fortinet","product":"Fortinet FortiWLM","versions":[{"version":"FortiWLM 8.6.1, 8.6.0, 8.5.2, 8.5.1, 8.5.0, 8.4.2, 8.4.1, 8.4.0, 8.3.2, 8.3.1, 8.3.0, 8.2.2","status":"affected"}]}],"references":[{"url":"https://fortiguard.com/advisory/FG-IR-21-129","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","exploitCodeMaturity":"PROOF_OF_CONCEPT","integrityImpact":"HIGH","privilegesRequired":"LOW","remediationLevel":"NOT_DEFINED","reportConfidence":"CONFIRMED","scope":"UNCHANGED","temporalScore":8.3,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C","version":"3.1"}}],"problemTypes":[{"descriptions":[{"description":"Information disclosure","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"fortinet","dateUpdated":"2021-12-08T11:31:41.000Z","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@fortinet.com","ID":"CVE-2021-42760","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Fortinet FortiWLM","version":{"version_data":[{"version_value":"FortiWLM 8.6.1, 8.6.0, 8.5.2, 8.5.1, 8.5.0, 8.4.2, 8.4.1, 8.4.0, 8.3.2, 8.3.1, 8.3.0, 8.2.2"}]}}]},"vendor_name":"Fortinet"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests."}]},"impact":{"cvss":{"attackComplexity":"Low","attackVector":"Network","availabilityImpact":"High","baseScore":8.3,"baseSeverity":"High","confidentialityImpact":"High","integrityImpact":"High","privilegesRequired":"Low","scope":"Unchanged","userInteraction":"None","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Information disclosure"}]}]},"references":{"reference_data":[{"name":"https://fortiguard.com/advisory/FG-IR-21-129","refsource":"CONFIRM","url":"https://fortiguard.com/advisory/FG-IR-21-129"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/advisory/FG-IR-21-129","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T03:38:50.069Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-23T14:13:12.811658Z","id":"CVE-2021-42760","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-25T13:41:54.810Z"}}]}}}