CVE-2024-21757CWE-620

A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as…

Medium · published August 13, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
8.3
In the wild
Unconfirmed
What it is

A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, allows an attacker to modify admin passwords via the device configuration backup.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N/E:P/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00191 · 8.3th percentile
Weakness
CWE-620 · Unverified Password Change
Published
2024-08-13T15:51Z
EPSS history
Timeline
  • 13 AUG 15:51Z
    A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as…
    cvelistv5