Lucene search

[email protected]CVE-2024-23669

HistoryJun 05, 2024 - 8:15 a.m.

CVE-2024-23669

2024-06-0508:15:09

CWE-20

CWE-863

[email protected]

web.nvd.nist.gov

vulnerability

cve-2024-23669

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

29.0%

JSON

An improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6.3.0 and 6.2.3 through 6.2.4 and 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.

Affected configurations

NVD

Node

fortinetfortiwebmanagerRange6.2.3–6.2.5

fortinetfortiwebmanagerRange7.0.0–7.0.5

fortinetfortiwebmanagerMatch6.0.2

fortinetfortiwebmanagerMatch6.3.0

fortinetfortiwebmanagerMatch7.2.0

CPENameOperatorVersion
fortinet:fortiwebmanagerfortinet fortiwebmanagerlt6.2.5
fortinet:fortiwebmanagerfortinet fortiwebmanagerlt7.0.5
fortinet:fortiwebmanagerfortinet fortiwebmanagereq6.0.2
fortinet:fortiwebmanagerfortinet fortiwebmanagereq6.3.0
fortinet:fortiwebmanagerfortinet fortiwebmanagereq7.2.0

CPE	Name	Operator	Version
fortinet:fortiwebmanager	fortinet fortiwebmanager	lt	6.2.5
fortinet:fortiwebmanager	fortinet fortiwebmanager	lt	7.0.5
fortinet:fortiwebmanager	fortinet fortiwebmanager	eq	6.0.2
fortinet:fortiwebmanager	fortinet fortiwebmanager	eq	6.3.0
fortinet:fortiwebmanager	fortinet fortiwebmanager	eq	7.2.0

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiWebManager",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "7.2.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.4",
        "status": "affected"
      },
      {
        "version": "6.3.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.3",
        "lessThanOrEqual": "6.2.4",
        "status": "affected"
      },
      {
        "version": "6.0.2",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.fortinet.com/psirt/FG-IR-23-222

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

29.0%

JSON

Related for CVE-2024-23669

nvd1 cvelist1 vulnrichment1