Medium · 5.4 CVE-2021-24017 EUVD-2021-10937GHSA-rgxm-gc8m-pfh9

An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and…

Published Sep 30, 2021 · Updated Oct 25, 2024 · Assigned by fortinet

Vendor: Fortinet Product: Fortinet FortiManager Category: Network devices

Description

An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler.

Affected products

Vendor	Product	Affected	Fixed
Fortinet	Fortinet FortiManager	FortiManager 6.4.3, 6.2.6	—

References

https://fortiguard.com/advisory/FG-IR-20-189