What is CVE-2021-24017?

CVE-2021-24017 is a medium-severity vulnerability in Fortinet Fortimanager, classified under Improper Authentication. CVSS score: 5.4/10. Published 2021-09-30.

How severe is CVE-2021-24017?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Auth bypass in Fortinet Fortimanager

CVE-2021-24017

An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler.

Vulnerability class: Broken Authentication

EPSS: 0.005 (41.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.

Affected products

Fortinet Fortimanager
Fortinet Fortimanager — versions FortiManager 6.4.3, 6.2.6

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

psirt@fortinet.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2021-24017?: CVE-2021-24017 is a medium-severity vulnerability in Fortinet Fortimanager, classified under Improper Authentication. CVSS score: 5.4/10. Published 2021-09-30.
How severe is CVE-2021-24017?: Medium severity. CVSS v3 base score is 5.4 out of 10.