description: An incorrect user management vulnerability [CWE-286] in the FortiManager version 6.4.6 and below VDOM creation component may allow an attacker to access a FortiGate without a password via newly created VDOMs after the super_admin account is deleted.
problem types: Improper access control
affected:
{
vendor: Fortinet
product: FortiManager
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.1, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.7, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.8, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:H/E:F/RL:O/RC:C
]
solutions: Please upgrade to FortiManager version 7.0.2 or above
Please upgrade to FortiManager version 6.4.8 or above
Please upgrade to FortiManager version 6.2.9 or above