Lucene search

FortinetCVELIST:CVE-2021-24006

HistorySep 06, 2021 - 6:56 p.m.

CVE-2021-24006

2021-09-0618:56:19

fortinet

www.cve.org

improper access control

fortimanager

restricted user

sd-wan orchestrator

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

36.9%

JSON

An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directly visiting its URL.

CNA Affected

[
  {
    "product": "Fortinet FortiManager",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiManager 6.4.0 to 6.4.3"
      }
    ]
  }
]

References

fortiguard.com/advisory/FG-IR-20-061