CVE-2024-23667
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
An improper authorization vulnerability in Fortinet FortiWebManager allows unauthorized attackers to execute code or commands via HTTP requests or CLI. The issue affects multiple versions of the product.
Risk Assessment
An attacker could take control of the FortiWeb manager, compromising the confidentiality, integrity, and availability of managed devices and data.
Recommendation
Immediately update FortiWebManager to the patched version available in the Fortinet security advisory. Restrict access to management interfaces to trusted networks only.
Other vulnerabilities in FortiWebManager
See all- CVE-2024-23669Medium
An improper authorization vulnerability in Fortinet FortiWebManager allows an unauthorized attacker to execute code or commands via HTTP requests or CLI. Affected versions: 7.2.0, 7.0.0-7.0.4, 6.3.0, 6.2.3-6.2.4, and 6.0.2.
- CVE-2024-23670High
An improper authorization vulnerability in Fortinet FortiWebManager allows unauthorized attackers to execute code or commands via HTTP requests or CLI. The issue affects multiple versions of the product.
- CVE-2024-23668High
An improper authorization vulnerability in Fortinet FortiWebManager allows unauthorized attackers to execute code or commands via HTTP requests or CLI. The issue affects multiple versions of the product.
Original NVD description (English source)
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.