7.8

CVE-2024-21757

A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, allows an attacker to modify admin passwords via the device configuration backup.

Data is provided by the National Vulnerability Database (NVD)
Fortinet ≫ Fortianalyzer Version >= 7.0.0 < 7.0.11
Fortinet ≫ Fortianalyzer Version >= 7.2.0 < 7.2.5
Fortinet ≫ Fortianalyzer Version >= 7.4.0 < 7.4.2
Fortinet ≫ Fortimanager Version >= 7.0.0 < 7.0.11
Fortinet ≫ Fortimanager Version >= 7.2.0 < 7.2.5
Fortinet ≫ Fortimanager Version >= 7.4.0 < 7.4.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.1% 0.29
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
psirt@fortinet.com 6.1 1.8 4.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CWE-620 Unverified Password Change

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.