CVE-2024-23669
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
An improper authorization vulnerability in Fortinet FortiWebManager allows an unauthorized attacker to execute code or commands via HTTP requests or CLI. Affected versions: 7.2.0, 7.0.0-7.0.4, 6.3.0, 6.2.3-6.2.4, and 6.0.2.
Risk Assessment
An attacker can take control of the FortiWebManager, compromising the confidentiality, integrity, and availability of managed devices and data.
Recommendation
Immediately upgrade FortiWebManager to the patched version provided in the Fortinet advisory. Restrict management interface access to trusted networks only.
Other vulnerabilities in FortiWebManager
See all- CVE-2024-23670High
An improper authorization vulnerability in Fortinet FortiWebManager allows unauthorized attackers to execute code or commands via HTTP requests or CLI. The issue affects multiple versions of the product.
- CVE-2024-23668High
An improper authorization vulnerability in Fortinet FortiWebManager allows unauthorized attackers to execute code or commands via HTTP requests or CLI. The issue affects multiple versions of the product.
- CVE-2024-23667High
An improper authorization vulnerability in Fortinet FortiWebManager allows unauthorized attackers to execute code or commands via HTTP requests or CLI. The issue affects multiple versions of the product.
Original NVD description (English source)
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS