CVE-2024-23669

HighCVSS 8.8/10Last modified Jul 8, 2026

Description

An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-863

Affected software

Vendor	Product	Versions
Fortinet	FortiWebManager	7.2.0; >= 7.0.0, <= 7.0.4; 6.3.0; >= 6.2.3, <= 6.2.4; 6.0.2
fortinet	fortiweb_manager	7.2.0; >= 7.0.0, <= 7.0.4; 6.3.0; >= 6.2.3, <= 6.2.4; 6.0.2

References

https://fortiguard.fortinet.com/psirt/FG-IR-23-222Vendor Advisory
https://fortiguard.fortinet.com/psirt/FG-IR-23-222Vendor Advisory

Timeline

Published: Jun 5, 2024
Last modified: Jul 8, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-236708.8An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2 CVE-2024-236718.1A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3,CVE-2024-236726.3Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections CVE-2024-236737.5Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of A CVE-2024-236749.6The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. A m CVE-2024-236756.5In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use CVE-2024-236763.5In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not hav CVE-2024-236775.3In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.CVE-2024-236788.8In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results CVE-2024-236799.8Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions CVE-2024-23684.3The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due CVE-2024-236805.3AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.