CVE-2021-24006: 
Fortinet FortiManager vulnerability analysis and mitigation

An improper access control vulnerability (CVE-2021-24006) was discovered in FortiManager versions 6.4.0 to 6.4.3. The vulnerability allows an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directly visiting its URL. This security issue was disclosed on August 3, 2021, and received a CVSS score of 6.2, indicating medium severity (Fortiguard Advisory).

The vulnerability is classified as an improper access control issue (CWE-284). It specifically affects FortiManager versions 6.4.0 through 6.4.3, allowing authenticated users with restricted profiles to bypass intended access restrictions. The vulnerability received a CVSS v3 score of 6.2, categorizing it as a medium severity issue (Fortiguard Advisory).

The vulnerability enables authenticated users with restricted profiles to gain unauthorized access to the SD-WAN Orchestrator panel, potentially compromising the intended access control mechanisms of the FortiManager system (Fortiguard Advisory).

Fortinet has released patches to address this vulnerability. Users are advised to upgrade to FortiManager version 6.4.4 or above, or alternatively to version 7.0.0 or above (Fortiguard Advisory).