CVE-2024-23668
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
An improper authorization vulnerability in Fortinet FortiWebManager allows unauthorized attackers to execute code or commands via HTTP requests or CLI. The issue affects multiple versions of the product.
Risk Assessment
An attacker can remotely take control of the device, compromising the confidentiality, integrity, and availability of managed web applications.
Recommendation
Immediately upgrade FortiWebManager to the patched version available in the Fortinet advisory. Restrict access to management interfaces to trusted networks only.
Other vulnerabilities in FortiWebManager
See all- CVE-2024-23669Medium
An improper authorization vulnerability in Fortinet FortiWebManager allows an unauthorized attacker to execute code or commands via HTTP requests or CLI. Affected versions: 7.2.0, 7.0.0-7.0.4, 6.3.0, 6.2.3-6.2.4, and 6.0.2.
- CVE-2024-23670High
An improper authorization vulnerability in Fortinet FortiWebManager allows unauthorized attackers to execute code or commands via HTTP requests or CLI. The issue affects multiple versions of the product.
- CVE-2024-23667High
An improper authorization vulnerability in Fortinet FortiWebManager allows unauthorized attackers to execute code or commands via HTTP requests or CLI. The issue affects multiple versions of the product.
Original NVD description (English source)
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.