Search
Find a vulnerability
Search criteria
10 vulnerabilities found for fortiweb_manager by fortinet
CVE-2024-23669 (GCVE-0-2024-23669)
Vulnerability from nvd – Published: 2024-06-05 07:45 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-05 14:06 UTC
CWE
- CWE-20 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiweb_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23669",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-05T14:06:39.473309Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-05T14:11:01.521Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.914Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23669",
"datePublished": "2024-06-05T07:45:35.018Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23670 (GCVE-0-2024-23670)
Vulnerability from nvd – Published: 2024-06-03 09:48 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 16:51 UTC
CWE
- CWE-285 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.0.0 , ≤ 7.0.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.3.0
cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.2.3 , ≤ 6.2.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.0.2
cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23670",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:51:43.637231Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:45:45.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.445Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.905Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23670",
"datePublished": "2024-06-03T09:48:12.424Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23668 (GCVE-0-2024-23668)
Vulnerability from nvd – Published: 2024-06-03 09:48 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 16:42 UTC
CWE
- CWE-20 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.0.0 , ≤ 7.0.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.3.0
cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.2.3 , ≤ 6.2.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.0.2
cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23668",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:42:57.390397Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-23T16:24:12.772Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.289Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.984Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23668",
"datePublished": "2024-06-03T09:48:24.625Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23667 (GCVE-0-2024-23667)
Vulnerability from nvd – Published: 2024-06-03 09:48 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 16:49 UTC
CWE
- CWE-285 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.0.0 , ≤ 7.0.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.3.0
cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.2.3 , ≤ 6.2.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.0.2
cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23667",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:49:28.332661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:45:36.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.346Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.905Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23667",
"datePublished": "2024-06-03T09:48:30.708Z",
"dateReserved": "2024-01-19T08:23:28.612Z",
"dateUpdated": "2026-07-08T13:03:45.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2017-14189 (GCVE-0-2017-14189)
Vulnerability from nvd – Published: 2017-11-29 19:00 – Updated: 2024-10-25 14:33
VLAI
EPSS
VEX
Summary
An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the provided password.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-24 20:11 UTC
CWE
- Improper Access Control
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/101953 | vdb-entryx_refsource_BID |
| https://fortiguard.com/advisory/FG-IR-17-248 | x_refsource_CONFIRM |
| http://www.securitytracker.com/id/1039892 | vdb-entryx_refsource_SECTRACK |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet, Inc. | FortiWebManager |
Affected:
5.8.0
|
Date Public
2017-11-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T19:20:41.279Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "101953",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/101953"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://fortiguard.com/advisory/FG-IR-17-248"
},
{
"name": "1039892",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1039892"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2017-14189",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-24T20:11:09.874728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-25T14:33:19.496Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "FortiWebManager",
"vendor": "Fortinet, Inc.",
"versions": [
{
"status": "affected",
"version": "5.8.0"
}
]
}
],
"datePublic": "2017-11-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the provided password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Access Control",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-01T10:57:01.000Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "101953",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/101953"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://fortiguard.com/advisory/FG-IR-17-248"
},
{
"name": "1039892",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1039892"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@fortinet.com",
"DATE_PUBLIC": "2017-11-22T00:00:00",
"ID": "CVE-2017-14189",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "FortiWebManager",
"version": {
"version_data": [
{
"version_value": "5.8.0"
}
]
}
}
]
},
"vendor_name": "Fortinet, Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the provided password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "101953",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101953"
},
{
"name": "https://fortiguard.com/advisory/FG-IR-17-248",
"refsource": "CONFIRM",
"url": "https://fortiguard.com/advisory/FG-IR-17-248"
},
{
"name": "1039892",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1039892"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2017-14189",
"datePublished": "2017-11-29T19:00:00.000Z",
"dateReserved": "2017-09-07T00:00:00.000Z",
"dateUpdated": "2024-10-25T14:33:19.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-23669 (GCVE-0-2024-23669)
Vulnerability from cvelistv5 – Published: 2024-06-05 07:45 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-05 14:06 UTC
CWE
- CWE-20 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiweb_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23669",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-05T14:06:39.473309Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-05T14:11:01.521Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.914Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23669",
"datePublished": "2024-06-05T07:45:35.018Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23667 (GCVE-0-2024-23667)
Vulnerability from cvelistv5 – Published: 2024-06-03 09:48 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 16:49 UTC
CWE
- CWE-285 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.0.0 , ≤ 7.0.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.3.0
cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.2.3 , ≤ 6.2.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.0.2
cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23667",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:49:28.332661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:45:36.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.346Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.905Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23667",
"datePublished": "2024-06-03T09:48:30.708Z",
"dateReserved": "2024-01-19T08:23:28.612Z",
"dateUpdated": "2026-07-08T13:03:45.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23668 (GCVE-0-2024-23668)
Vulnerability from cvelistv5 – Published: 2024-06-03 09:48 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 16:42 UTC
CWE
- CWE-20 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.0.0 , ≤ 7.0.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.3.0
cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.2.3 , ≤ 6.2.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.0.2
cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23668",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:42:57.390397Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-23T16:24:12.772Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.289Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.984Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23668",
"datePublished": "2024-06-03T09:48:24.625Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-23670 (GCVE-0-2024-23670)
Vulnerability from cvelistv5 – Published: 2024-06-03 09:48 – Updated: 2026-07-08 13:03
VLAI
EPSS
VEX
Summary
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 16:51 UTC
CWE
- CWE-285 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiWebManager |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.4 (semver) Affected: 6.3.0 Affected: 6.2.3 , ≤ 6.2.4 (semver) Affected: 6.0.2 cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.2.0
cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
7.0.0 , ≤ 7.0.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.3.0
cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.2.3 , ≤ 6.2.4
(custom)
cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:* |
|
| fortinet | fortiweb_manager |
Affected:
6.0.2
cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.2.3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiweb_manager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiweb_manager",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23670",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:51:43.637231Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:45:45.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.445Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiWebManager",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"lessThanOrEqual": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T13:03:45.905Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-23670",
"datePublished": "2024-06-03T09:48:12.424Z",
"dateReserved": "2024-01-19T08:23:28.613Z",
"dateUpdated": "2026-07-08T13:03:45.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2017-14189 (GCVE-0-2017-14189)
Vulnerability from cvelistv5 – Published: 2017-11-29 19:00 – Updated: 2024-10-25 14:33
VLAI
EPSS
VEX
Summary
An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the provided password.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-24 20:11 UTC
CWE
- Improper Access Control
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/101953 | vdb-entryx_refsource_BID |
| https://fortiguard.com/advisory/FG-IR-17-248 | x_refsource_CONFIRM |
| http://www.securitytracker.com/id/1039892 | vdb-entryx_refsource_SECTRACK |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet, Inc. | FortiWebManager |
Affected:
5.8.0
|
Date Public
2017-11-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T19:20:41.279Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "101953",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/101953"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://fortiguard.com/advisory/FG-IR-17-248"
},
{
"name": "1039892",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1039892"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2017-14189",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-24T20:11:09.874728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-25T14:33:19.496Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "FortiWebManager",
"vendor": "Fortinet, Inc.",
"versions": [
{
"status": "affected",
"version": "5.8.0"
}
]
}
],
"datePublic": "2017-11-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the provided password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Access Control",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-01T10:57:01.000Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "101953",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/101953"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://fortiguard.com/advisory/FG-IR-17-248"
},
{
"name": "1039892",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1039892"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@fortinet.com",
"DATE_PUBLIC": "2017-11-22T00:00:00",
"ID": "CVE-2017-14189",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "FortiWebManager",
"version": {
"version_data": [
{
"version_value": "5.8.0"
}
]
}
}
]
},
"vendor_name": "Fortinet, Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the provided password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "101953",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101953"
},
{
"name": "https://fortiguard.com/advisory/FG-IR-17-248",
"refsource": "CONFIRM",
"url": "https://fortiguard.com/advisory/FG-IR-17-248"
},
{
"name": "1039892",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1039892"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2017-14189",
"datePublished": "2017-11-29T19:00:00.000Z",
"dateReserved": "2017-09-07T00:00:00.000Z",
"dateUpdated": "2024-10-25T14:33:19.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}