Search
Find a vulnerability
Search criteria
8 vulnerabilities found for FortiWebManager by Fortinet
CVE-2024-23669 (GCVE-0-2024-23669)
Vulnerability from nvd – Published: 2024-06-05 07:45 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-05 14:06 UTC
CWE
- CWE-20 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiweb_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23669",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-05T14:06:39.473309Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-05T14:11:01.521Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.914Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23669",
"datePublished": "2024-06-05T07:45:35.018Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23670 (GCVE-0-2024-23670)
Vulnerability from nvd – Published: 2024-06-03 09:48 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 16:51 UTC
CWE
- CWE-285 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.0.0 , ≤ 7.0.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.3.0
cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.2.3 , ≤ 6.2.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.0.2
cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23670",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:51:43.637231Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:45:45.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.445Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.905Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23670",
"datePublished": "2024-06-03T09:48:12.424Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23668 (GCVE-0-2024-23668)
Vulnerability from nvd – Published: 2024-06-03 09:48 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 16:42 UTC
CWE
- CWE-20 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.0.0 , ≤ 7.0.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.3.0
cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.2.3 , ≤ 6.2.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.0.2
cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23668",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:42:57.390397Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-23T16:24:12.772Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.289Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.984Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23668",
"datePublished": "2024-06-03T09:48:24.625Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23667 (GCVE-0-2024-23667)
Vulnerability from nvd – Published: 2024-06-03 09:48 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 16:49 UTC
CWE
- CWE-285 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.0.0 , ≤ 7.0.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.3.0
cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.2.3 , ≤ 6.2.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.0.2
cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23667",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:49:28.332661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:45:36.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.346Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.905Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23667",
"datePublished": "2024-06-03T09:48:30.708Z",
"dateReserved": "2024-01-19T08:23:28.612Z",
"dateUpdated": "2026-07-08T13:03:45.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23669 (GCVE-0-2024-23669)
Vulnerability from cvelistv5 – Published: 2024-06-05 07:45 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-05 14:06 UTC
CWE
- CWE-20 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiweb_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23669",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-05T14:06:39.473309Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-05T14:11:01.521Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.914Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23669",
"datePublished": "2024-06-05T07:45:35.018Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23667 (GCVE-0-2024-23667)
Vulnerability from cvelistv5 – Published: 2024-06-03 09:48 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 16:49 UTC
CWE
- CWE-285 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.0.0 , ≤ 7.0.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.3.0
cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.2.3 , ≤ 6.2.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.0.2
cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23667",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:49:28.332661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:45:36.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.346Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.905Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23667",
"datePublished": "2024-06-03T09:48:30.708Z",
"dateReserved": "2024-01-19T08:23:28.612Z",
"dateUpdated": "2026-07-08T13:03:45.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23668 (GCVE-0-2024-23668)
Vulnerability from cvelistv5 – Published: 2024-06-03 09:48 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 16:42 UTC
CWE
- CWE-20 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.0.0 , ≤ 7.0.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.3.0
cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.2.3 , ≤ 6.2.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.0.2
cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23668",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:42:57.390397Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-23T16:24:12.772Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.289Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.984Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23668",
"datePublished": "2024-06-03T09:48:24.625Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23670 (GCVE-0-2024-23670)
Vulnerability from cvelistv5 – Published: 2024-06-03 09:48 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 16:51 UTC
CWE
- CWE-285 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.0.0 , ≤ 7.0.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.3.0
cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.2.3 , ≤ 6.2.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.0.2
cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23670",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:51:43.637231Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:45:45.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.445Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.905Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23670",
"datePublished": "2024-06-03T09:48:12.424Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}