CVE-2024-23107
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authent
Severity
Medium 5.2
CVSS 3.1
Exploited
Not listed
EPSS
0.002
10.2th percentile
Discovered by
Not disclosed
Published
Jun 3, 2024
Assigned by fortinet
Description
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authenticated attacker to read password hashes of other administrators via CLI commands.
Weakness: CWE-200
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiWeb | Web & Application Security | cna-assigner |
Vendor-reported affected versions (2)
- Fortinet · FortiWeb
- fortinet · fortiweb
Vendor remediation
Please upgrade to FortiWeb version 7.4.1 or above Please upgrade to FortiWeb version 7.2.5 or above Please upgrade to FortiWeb version 7.0.9 or above