Skip to content
OpenAdvisories
Medium · 6.3 CVE-2021-26107 EUVD-2021-12928GHSA-w484-2gxp-43x9

An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a rest…

Published Nov 2, 2021 · Updated Oct 25, 2024 · Assigned by fortinet

Vendor: Fortinet Product: Fortinet FortiManager Category: Network devices

Description

An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other VDOMs using VPN Manager.

Affected products

VendorProductAffectedFixed
Fortinet Fortinet FortiManager FortiManager 6.4.5, 6.4.4 —

References