Advisories · Technology

Fortinet FortiManager.

Every CVE that names Fortinet FortiManager among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2024-21757 CVE record

CVSS 5.5 Medium

Fortinet FortiManager: A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10…
- Fortinet FortiManager
- Fortinet FortiAnalyzer
- CWE-620
Not analysed yet 13 Aug 2024
CVE-2023-47542 CVE record

CVSS 6.3 Medium

Template injection in Fortinet FortiManager
- Fortinet FortiManager
- Code injection
Not analysed yet 9 Apr 2024
CVE-2023-41842 CVE record

CVSS 6.3 Medium

Uncontrolled format string in Fortinet FortiPortal and others
- Fortinet FortiPortal
- Fortinet FortiAnalyzer-BigData
- Memory corruption
Not analysed yet 12 Mar 2024
CVE-2023-36554 CVE record

CVSS 7.7 High

Improper access control in Fortinet FortiManager
- Fortinet FortiManager
- Broken access control
Not analysed yet 12 Mar 2024
CVE-2023-42791 CVE record

CVSS 8.6 High

Path traversal in Fortinet FortiManager and others
- Fortinet FortiManager
- Fortinet FortiAnalyzer
- Path traversal
Not analysed yet 20 Feb 2024
CVE-2023-44253 CVE record

CVSS 4.7 Medium

Information disclosure in Fortinet FortiManager and others
- Fortinet FortiManager
- Fortinet FortiAnalyzer
- Information disclosure
Not analysed yet 15 Feb 2024
CVE-2023-40719 CVE record

CVSS 4.1 Medium

Hard-coded credentials in Fortinet FortiAnalyzer and others
- Fortinet FortiAnalyzer
- Fortinet FortiManager
- Hard-coded credentials
Not analysed yet 14 Nov 2023
CVE-2023-44256 CVE record

CVSS 6.4 Medium

Path traversal in Fortinet FortiAnalyzer and others
- Fortinet FortiAnalyzer
- Fortinet FortiManager
- Path traversal
Not analysed yet 20 Oct 2023
CVE-2023-41679 CVE record

CVSS 7.7 High

Improper access control in Fortinet FortiManager
- Fortinet FortiManager
- Broken access control
Not analysed yet 10 Oct 2023
CVE-2023-25607 CVE record

CVSS 7.4 High

OS command injection in Fortinet FortiAnalyzer and others
- Fortinet FortiAnalyzer
- Fortinet FortiManager
- Command injection
Not analysed yet 10 Oct 2023
CVE-2023-41838 CVE record

CVSS 6.9 Medium

OS command injection in Fortinet FortiAnalyzer and others
- Fortinet FortiAnalyzer
- Fortinet FortiManager
- Command injection
Not analysed yet 10 Oct 2023
CVE-2023-42788 CVE record

CVSS 7.6 High

OS command injection in Fortinet FortiAnalyzer and others
- Fortinet FortiAnalyzer
- Fortinet FortiManager
- Command injection
Not analysed yet 10 Oct 2023
CVE-2023-42787 CVE record

CVSS 6.2 Medium

Fortinet FortiAnalyzer: A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet…
- Fortinet FortiAnalyzer
- Fortinet FortiManager
- CWE-602
Not analysed yet 10 Oct 2023
CVE-2023-44249 CVE record

CVSS 4.1 Medium

Insecure direct object reference in Fortinet FortiManager and others
- Fortinet FortiManager
- Fortinet FortiAnalyzer
- Broken access control
Not analysed yet 10 Oct 2023
CVE-2023-36638 CVE record

CVSS 4.2 Medium

Improper access control in Fortinet FortiManager and others
- Fortinet FortiManager
- Fortinet FortiAnalyzer
- Broken access control
Not analysed yet 13 Sept 2023
CVE-2022-22305 CVE record

CVSS 5.4 Medium

Improper certificate validation in Fortinet FortiAnalyzer and others
- Fortinet FortiAnalyzer
- Fortinet FortiSandbox
- Weak cryptography or TLS
Not analysed yet 1 Sept 2023
CVE-2021-43072 CVE record

CVSS 6.3 Medium

Buffer overflow in Fortinet FortiAnalyzer and others
- Fortinet FortiAnalyzer
- Fortinet FortiManager
- Memory corruption
Not analysed yet 18 Jul 2023
CVE-2023-25606 CVE record

CVSS 6.2 Medium

Path traversal in Fortinet FortiManager and others
- Fortinet FortiManager
- Fortinet FortiAnalyzer
- Path traversal
Not analysed yet 11 Jul 2023
CVE-2023-25609 CVE record

CVSS 4.2 Medium

Server-side request forgery in Fortinet FortiAnalyzer and others
- Fortinet FortiAnalyzer
- Fortinet FortiManager
- Server-side request forgery (SSRF)
Not analysed yet 13 Jun 2023
CVE-2023-22642 CVE record

CVSS 6.8 Medium

Improper certificate validation in Fortinet FortiAnalyzer and others
- Fortinet FortiAnalyzer
- Fortinet FortiManager
- Weak cryptography or TLS
Not analysed yet 11 Apr 2023
CVE-2022-27490 CVE record

CVSS 5.1 Medium

Information disclosure in Fortinet FortiManager and others
- Fortinet FortiManager
- Fortinet FortiAnalyzer
- Information disclosure
Not analysed yet 7 Mar 2023
CVE-2022-45857 CVE record

CVSS 6.0 Medium

Fortinet FortiManager: An incorrect user management vulnerability [CWE-286] in the FortiManager version 6.4.6…
- Fortinet FortiManager
- CWE-286
Not analysed yet 5 Jan 2023
CVE-2022-38377 CVE record

CVSS 4.1 Medium

Improper access control in Fortinet FortiManager and others
- Fortinet FortiManager
- Fortinet FortiAnalyzer
- Broken access control
Not analysed yet 25 Nov 2022
CVE-2022-22303 CVE record

CVSS 2.8 Low

An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager versions prior to 7.0.2, 6.4.7 and 6.2.9 may allow a low privileged authenticated…
- Fortinet FortiManager
Not analysed yet 2 Mar 2022
CVE-2021-42757 CVE record

CVSS 6.3 Medium

Buffer overflow in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiDDoS-F
- Memory corruption
Not analysed yet 8 Dec 2021
CVE-2021-36192 CVE record

CVSS 5.2 Medium

An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiManager 7.0.1 and below, 6.4.6 and below, 6.2.x, 6.0.x, 5.6.0 may allow a FortiGate user to see scripts f…
- Fortinet FortiManager
Not analysed yet 3 Nov 2021
CVE-2021-26107 CVE record

CVSS 6.3 Medium

An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other…
- Fortinet FortiManager
Not analysed yet 2 Nov 2021
CVE-2021-24017 CVE record

CVSS 5.4 Medium

Fortinet FortiManager: An improper authentication in Fortinet FortiManager version 6.4.3 and below…
- Fortinet FortiManager
Not analysed yet 30 Sept 2021
CVE-2021-24016 CVE record

CVSS 3.7 Low

Fortinet FortiManager: An improper neutralization of formula elements in a csv file in Fortinet FortiManager…
- Fortinet FortiManager
Not analysed yet 30 Sept 2021
CVE-2021-24006 CVE record

CVSS 6.3 Medium

An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directl…
- Fortinet FortiManager
Not analysed yet 6 Sept 2021
CVE-2020-12811 CVE record

CVSS 4.9 Medium

Cross-site scripting in Fortinet FortiManager and others
- Fortinet FortiManager
- Fortinet FortiAnalyzer
- Cross-site scripting (XSS)
Not analysed yet 24 Sept 2020
CVE-2020-9289 CVE record

Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configu…
- Fortinet FortiManager
Not analysed yet 16 Jun 2020
CVE-2019-17654 CVE record

An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform a Cross-Site WebSocket Hijacking (CSWSH)…
- Fortinet FortiManager
Not analysed yet 15 Mar 2020
CVE-2019-6695 CVE record

Fortinet FortiManager: Lack of root file system integrity checking in Fortinet FortiManager VM application…
- Fortinet FortiManager
Not analysed yet 23 Aug 2019
CVE-2018-13375 CVE record

Fortinet FortiAnalyzer: An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0…
- Fortinet FortiAnalyzer
- Fortinet FortiManager
Not analysed yet 28 May 2019
CVE-2016-8495 CVE record

Fortinet FortiManager: An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through…
- Fortinet FortiManager
Not analysed yet 13 Feb 2017