{"id":"CVE-2024-23669","state":"PUBLISHED","title":"An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 ","description":"An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.","publishedAt":"2024-06-05T07:45:35.018Z","updatedAt":"2026-07-08T13:03:45.914Z","severity":{"score":6.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:X","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiWebManager"],"affected":[{"vendor":"Fortinet","product":"FortiWebManager","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.4","versionType":"semver"},{"version":"6.3.0","status":"affected"},{"version":"6.2.3","status":"affected","lessThanOrEqual":"6.2.4","versionType":"semver"},{"version":"6.0.2","status":"affected"}],"cpes":["cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"]}],"references":["https://fortiguard.fortinet.com/psirt/FG-IR-23-222"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/23xxx/CVE-2024-23669.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-23669","state":"PUBLISHED","datePublished":"2024-06-05T07:45:35.018Z","dateUpdated":"2026-07-08T13:03:45.914Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2024-01-19T08:23:28.613Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."}],"affected":[{"vendor":"Fortinet","product":"FortiWebManager","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.4","versionType":"semver"},{"version":"6.3.0","status":"affected"},{"version":"6.2.3","status":"affected","lessThanOrEqual":"6.2.4","versionType":"semver"},{"version":"6.0.2","status":"affected"}],"cpes":["cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:7.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:6.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:6.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*"]}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-23-222","name":"https://fortiguard.fortinet.com/psirt/FG-IR-23-222"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:X"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","lang":"en","description":"Execute unauthorized code or commands","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2026-07-08T13:03:45.914Z"},"solutions":[{"lang":"en","value":"Upgrade to FortiWebManager version 7.4.0 or above\nUpgrade to FortiWebManager version 7.2.1 or above\nUpgrade to FortiWebManager version 7.0.5 or above\nUpgrade to FortiWebManager version 6.3.1 or above\nUpgrade to FortiWebManager version 6.2.5 or above"}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"fortinet","product":"fortiweb_manager","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.4","versionType":"semver"},{"version":"6.3.0","status":"affected"},{"version":"6.2.3","status":"affected","lessThanOrEqual":"6.2.4","versionType":"semver"},{"version":"6.0.2","status":"affected"}],"cpes":["cpe:2.3:a:fortinet:fortiweb_manager:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-05T14:06:39.473309Z","id":"CVE-2024-23669","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-05T14:11:01.521Z"}},{"title":"CVE Program Container","references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-23-222","name":"https://fortiguard.fortinet.com/psirt/FG-IR-23-222","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T23:06:25.272Z"}}]}}}