CVE-2024-23670
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
An improper authorization vulnerability in Fortinet FortiWebManager allows unauthorized attackers to execute code or commands via HTTP requests or CLI. The issue affects multiple versions of the product.
Risk Assessment
An attacker could take control of the device, execute arbitrary commands, or modify configuration, leading to compromise of integrity and confidentiality of managed systems.
Recommendation
Immediately update FortiWebManager to the patched version available in the Fortinet security advisory. Restrict management interface access to trusted networks only.
Other vulnerabilities in FortiWebManager
See all- CVE-2024-23669Medium
An improper authorization vulnerability in Fortinet FortiWebManager allows an unauthorized attacker to execute code or commands via HTTP requests or CLI. Affected versions: 7.2.0, 7.0.0-7.0.4, 6.3.0, 6.2.3-6.2.4, and 6.0.2.
- CVE-2024-23668High
An improper authorization vulnerability in Fortinet FortiWebManager allows unauthorized attackers to execute code or commands via HTTP requests or CLI. The issue affects multiple versions of the product.
- CVE-2024-23667High
An improper authorization vulnerability in Fortinet FortiWebManager allows unauthorized attackers to execute code or commands via HTTP requests or CLI. The issue affects multiple versions of the product.
Original NVD description (English source)
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.