CVE-2024-23107

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authenticated attacker to read password hashes of other administrators via CLI commands.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Fortinet	FortiWeb	7.4.0; >= 7.2.0, <= 7.2.4; >= 7.0.0, <= 7.0.8; >= 6.3.0, <= 6.3.23
fortinet	fortiweb	7.4.0; >= 7.2.0, <= 7.2.4; >= 7.0.0, <= 7.0.8; >= 6.3.0, <= 6.3.23

References

https://fortiguard.fortinet.com/psirt/FG-IR-23-191Vendor Advisory
https://fortiguard.fortinet.com/psirt/FG-IR-23-191Vendor Advisory

Timeline

Published: Jun 3, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-231089.8An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to CVE-2024-231099.8An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to CVE-2024-23115.4The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including,CVE-2024-231107.8A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.CVE-2024-231114.8An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and CVE-2024-231124.3An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0 CVE-2024-231139.8A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, Fo CVE-2024-231149.8Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe de CVE-2024-231157.2Centreon updateGroups SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod CVE-2024-231167.2Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar CVE-2024-231177.2Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu CVE-2024-231187.2Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute