First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-46671

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard of other administrators via crafted requests.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Fortinet	FortiWeb	>= 7.6.0, <= 7.6.2; >= 7.4.0, <= 7.4.6; >= 7.2.0, <= 7.2.10; >= 7.0.0, <= 7.0.11

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-184Vendor Advisory

Timeline

Published: Apr 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-466725.5In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion wpa_supplic CVE-2024-466737.8In the Linux kernel, the following vulnerability has been resolved: scsi: aacraid: Fix double-free on probe failure aac_probe_one() calls CVE-2024-466747.8In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: st: fix probed platform device ref count on probe error path CVE-2024-466755.5In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: Prevent USB core invalid event buffer address access CVE-2024-466765.5In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Add poll mod list filling check In case of im_protocols va CVE-2024-466775.5In the Linux kernel, the following vulnerability has been resolved: gtp: fix a potential NULL pointer dereference When sockfd_lookup() fai CVE-2024-466785.5In the Linux kernel, the following vulnerability has been resolved: bonding: change ipsec_lock from spin lock to mutex In the cited commit CVE-2024-466794.7In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings A sysfs re CVE-2024-46686.4The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Price Table and Post Slider widgets in all CVE-2024-466805.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix random crash seen while removing driver This CVE-2024-466815.5In the Linux kernel, the following vulnerability has been resolved: pktgen: use cpus_read_lock() in pg_net_init() I have seen the WARN_ON(CVE-2024-466825.5In the Linux kernel, the following vulnerability has been resolved: nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open Prior t

CVE-2024-46671: High severity, CVSS 7.2 | Vulnix