← Back

CVE-2024-21757

nvd nist
Published: Aug 13, 2024Modified: Jun 17, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, allows an attacker to modify admin passwords via the device configuration backup.

Affected (6)

Fortinet
2 products
Fortianalyzer
Fortimanager
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortianalyzer
From 7.0.0 to 7.0.11
Fortianalyzer
From 7.2.0 to 7.2.5
Fortianalyzer
From 7.4.0 to 7.4.2
Fortinet
Fortimanager
From 7.0.0 to 7.0.11
Fortimanager
From 7.2.0 to 7.2.5
Fortimanager
From 7.4.0 to 7.4.2

Related CWEs

CWE-620
Unverified Password Change
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.