CVE-2024-23669
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
An improper authorization vulnerability in Fortinet FortiWebManager allows an unauthorized attacker to execute code or commands via HTTP requests or CLI. Affected versions: 7.2.0, 7.0.0-7.0.4, 6.3.0, 6.2.3-6.2.4, and 6.0.2.
Risk Assessment
An attacker can take control of the FortiWebManager, compromising the confidentiality, integrity, and availability of managed devices and data.
Recommendation
Immediately upgrade FortiWebManager to the patched version provided in the Fortinet advisory. Restrict management interface access to trusted networks only.
Original NVD description (English source)
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.