CVE-2021-26107

published 2021-11-02

CVE-2021-26107: An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile…

medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C N I L A N

An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other VDOMs using VPN Manager.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortimanager	—	—
fortinet	fortimanager	—	—
fortinet	fortimanager	—	—
fortinet	fortinet_fortimanager	—	—

CWE-863