CVE-2024-23107
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authent
Severity
Medium 5.2
CVSS 3.1
Exploited
Not listed
EPSS
0.002
10.4th percentile
Discovered by
Vendor
Vendor advisory field
Published
Jun 3, 2024
Assigned by fortinet
Description
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authenticated attacker to read password hashes of other administrators via CLI commands.
Weakness: CWE-200
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiWeb | Web & Application Security | cna-assigner |
Vendor-reported products (2)
- Fortinet · FortiWeb
- fortinet · fortiweb
Credit
Internally discovered and reported by Kushal Arvind Shah of Fortinet's FortiGuard Labs.
Vendor remediation
Please upgrade to FortiWeb version 7.4.1 or above Please upgrade to FortiWeb version 7.2.5 or above Please upgrade to FortiWeb version 7.0.9 or above