CVE-2020-6641

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow an attacker to gain access to some user data via portal manager or portal users parameters.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-66435.4An improper neutralization of input vulnerability in the URL Description in Fortinet FortiIsolator version 1.2.2 allows a remote authenticat CVE-2020-66448.1An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user sessi CVE-2020-66465.4An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scriptin CVE-2020-66475.4An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site s CVE-2020-66486.5A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.CVE-2020-66499.8An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unex CVE-2020-66508.8UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutrali CVE-2020-66517.3Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functional CVE-2020-66527.8Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the sy CVE-2020-66533.9Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account o CVE-2020-66547.8A DLL Hijacking vulnerability in Eaton's 9000x Programming and Configuration Software v 2.0.38 and prior allows an attacker to execute arbit CVE-2020-66557.8The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity