Fortinet Fortimanager vulnerabilities

7 vulnerabilities

Known vulnerabilities in Fortinet Fortimanager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.3CVE-2021-26107fortinetfortimanager+1
EPSS score
0.51%
An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other VDOMs using VPN Manager.5.2CVE-2021-36192fortinetfortimanager+1
EPSS score
0.22%
An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiManager 7.0.1 and below, 6.4.6 and below, 6.2.x, 6.0.x, 5.6.0 may allow a FortiGate user to see scripts from other ADOMS.9.3CVE-2021-24016fortinetfortimanager+1
EPSS score
0.50%
An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host.5.4CVE-2021-24017fortinetfortimanager+1
EPSS score
0.55%
An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler.8.8CVE-2021-24006fortinetfortimanager+1
EPSS score
0.96%
An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directly visiting its URL.5.5CVE-2022-22303fortinetfortimanager+1
EPSS score
0.21%
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager versions prior to 7.0.2, 6.4.7 and 6.2.9 may allow a low privileged authenticated user to gain access to the FortiGate users credentials via the config conflict file.8.8CVE-2019-17654fortinetfortimanager+1
EPSS score
0.47%
An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform a Cross-Site WebSocket Hijacking (CSWSH) attack.