CVE-2021-26107

CWE-863 — Incorrect Authorization4 documents4 sources

Severity

4.3MEDIUM

EPSS

0.2%

top 55.34%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Fortinet Fortinet Fortimanager Fortinet Fortimanager

Timeline

PublishedNov 2

Latest updateMay 24

Description

An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other VDOMs using VPN Manager.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages2 packages

▶NVDfortinet/fortimanager6.4.4, 6.4.5+1

▶CVEListV5fortinet/fortinet_fortimanagerFortiManager 6.4.5, 6.4.4

🔴Vulnerability Details

GHSA

GHSA-w484-2gxp-43x9: An improper access control vulnerability [CWE-284] in FortiManager versions 6↗2022-05-24

▶

CVEList

CVE-2021-26107: An improper access control vulnerability [CWE-284] in FortiManager versions 6↗2021-11-02

▶

📋Vendor Advisories

Fortinet

An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated a...↗2021-11-02

▶