Refine your search
4 vulnerabilities found for FortiWebManager by Fortinet
CVE-2024-23669 (GCVE-0-2024-23669)
Vulnerability from cvelistv5
Published
2024-06-05 07:45
Modified
2026-07-08 13:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-20 - Execute unauthorized code or commands
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fortinet | FortiWebManager |
Version: 7.2.0 Version: 7.0.0 ≤ 7.0.4 Version: 6.3.0 Version: 6.2.3 ≤ 6.2.4 Version: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23669",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-05T14:06:39.473309Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-05T14:11:01.521Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.914Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23669",
"datePublished": "2024-06-05T07:45:35.018Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23667 (GCVE-0-2024-23667)
Vulnerability from cvelistv5
Published
2024-06-03 09:48
Modified
2026-07-08 13:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-285 - Execute unauthorized code or commands
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fortinet | FortiWebManager |
Version: 7.2.0 Version: 7.0.0 ≤ 7.0.4 Version: 6.3.0 Version: 6.2.3 ≤ 6.2.4 Version: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23667",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:49:28.332661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:45:36.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.346Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.905Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23667",
"datePublished": "2024-06-03T09:48:30.708Z",
"dateReserved": "2024-01-19T08:23:28.612Z",
"dateUpdated": "2026-07-08T13:03:45.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23668 (GCVE-0-2024-23668)
Vulnerability from cvelistv5
Published
2024-06-03 09:48
Modified
2026-07-08 13:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-20 - Execute unauthorized code or commands
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fortinet | FortiWebManager |
Version: 7.2.0 Version: 7.0.0 ≤ 7.0.4 Version: 6.3.0 Version: 6.2.3 ≤ 6.2.4 Version: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23668",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:42:57.390397Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-23T16:24:12.772Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.289Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.984Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23668",
"datePublished": "2024-06-03T09:48:24.625Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23670 (GCVE-0-2024-23670)
Vulnerability from cvelistv5
Published
2024-06-03 09:48
Modified
2026-07-08 13:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-285 - Execute unauthorized code or commands
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fortinet | FortiWebManager |
Version: 7.2.0 Version: 7.0.0 ≤ 7.0.4 Version: 6.3.0 Version: 6.2.3 ≤ 6.2.4 Version: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23670",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:51:43.637231Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:45:45.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.445Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.905Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23670",
"datePublished": "2024-06-03T09:48:12.424Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}