{"id":"CVE-2024-21757","state":"PUBLISHED","title":"A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyz","description":"A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, allows an attacker to modify admin passwords via the device configuration backup.","publishedAt":"2024-08-13T15:51:57.495Z","updatedAt":"2024-08-13T17:48:37.502Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N/E:P/RL:O/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiManager","Fortinet FortiAnalyzer"],"affected":[{"vendor":"Fortinet","product":"FortiManager","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.1","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.4","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.10","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiAnalyzer","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.1","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.4","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.10","versionType":"semver"}]}],"references":["https://fortiguard.fortinet.com/psirt/FG-IR-23-467"],"weaknesses":["CWE-620"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/21xxx/CVE-2024-21757.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-21757","state":"PUBLISHED","datePublished":"2024-08-13T15:51:57.495Z","dateUpdated":"2024-08-13T17:48:37.502Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2024-01-02T10:15:00.526Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, allows an attacker to modify admin passwords via the device configuration backup."}],"affected":[{"vendor":"Fortinet","product":"FortiManager","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.1","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.4","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.10","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiAnalyzer","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.1","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.4","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.10","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-23-467","name":"https://fortiguard.fortinet.com/psirt/FG-IR-23-467"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N/E:P/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-620","lang":"en","description":"Escalation of privilege","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2024-08-13T15:51:57.495Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiManager version 7.4.2 or above \nPlease upgrade to FortiManager version 7.2.5 or above \nPlease upgrade to FortiManager version 7.0.11 or above \nPlease upgrade to FortiAnalyzer version 7.4.2 or above \nPlease upgrade to FortiAnalyzer version 7.2.5 or above \nPlease upgrade to FortiAnalyzer version 7.0.11 or above"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-13T17:32:07.480043Z","id":"CVE-2024-21757","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-13T17:48:37.502Z"}}]}}}