CVEvulnerability
CVE-2021-22131
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-07-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.4 MEDIUM — CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
- Weaknesses
- CWE-295
Description
A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below, Fortinet FortiTokenWinApp version 4.0.3 and below allows attacker to retrieve information disclosed via man-in-the-middle attacks.
Affected configurations
• fortinet fortitoken mobile 0.4.10
• fortinet fortitoken mobile 0.4.20
• fortinet fortitoken mobile 3.0.0
• fortinet fortitoken mobile 3.0.1
• fortinet fortitoken mobile 3.0.2
• fortinet fortitoken mobile 3.0.3
• fortinet fortitoken mobile 3.0.4
• fortinet fortitoken mobile 3.0.5
• fortinet fortitoken mobile 4.0.0
• fortinet fortitoken mobile 4.0.1
• fortinet fortitoken mobile 4.0.3
• fortinet fortitoken mobile 4.1.0
• fortinet fortitoken mobile 4.1.1
• fortinet fortitoken mobile 4.2.0
• fortinet fortitoken mobile 4.2.1
• fortinet fortitoken mobile 4.2.2
• fortinet fortitoken mobile 4.3.0
• fortinet fortitoken mobile 4.4.0
• fortinet fortitoken mobile 4.5.0
• fortinet fortitoken mobile 5.0.2
• fortinet fortitoken mobile 5.0.3
• fortinet fortitoken mobile 5.2.0
Related
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://fortiguard.com/advisory/FG-IR-21-024 Patch, Vendor Advisory
- https://fortiguard.com/advisory/FG-IR-21-024 Patch, Vendor Advisory