CyberCVE

CVE-2024-21757

A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 th

Severity
Medium 5.5
CVSS 3.1
Exploited
Not listed
EPSS
0.002
9.0th percentile
Discovered by
Not disclosed
Published
Aug 13, 2024
Assigned by fortinet

Description

A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, allows an attacker to modify admin passwords via the device configuration backup.

Weakness: CWE-620

Affected products

Vendor Product Category Matched by
Fortinet FortiAnalyzer SIEM & Log Management cna-assigner
Fortinet FortiManager Network & Security Management cna-assigner
Vendor-reported affected versions (2)
  • Fortinet · FortiManager
  • Fortinet · FortiAnalyzer

Vendor remediation

Please upgrade to FortiManager version 7.4.2 or above Please upgrade to FortiManager version 7.2.5 or above Please upgrade to FortiManager version 7.0.11 or above Please upgrade to FortiAnalyzer version 7.4.2 or above Please upgrade to FortiAnalyzer version 7.2.5 or above Please upgrade to FortiAnalyzer version 7.0.11 or above

References