CVE-2024-23665
Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and below, version 6.4.3 and below, version 6.3.23 and below may
Severity
Medium 5.6
CVSS 3.1
Exploited
Not listed
EPSS
0.005
41.1th percentile
Discovered by
Vendor
Vendor advisory field
Published
Jun 3, 2024
Assigned by fortinet
Description
Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and below, version 6.4.3 and below, version 6.3.23 and below may allow an authenticated attacker to perform unauthorized ADOM operations via crafted requests.
Weakness: CWE-285
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiWeb | Web & Application Security | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiWeb
Credit
Internally discovered and reported by Leslie Zhou of Fortinet Vulnerability Research team.
Vendor remediation
Please upgrade to FortiWeb version 7.4.3 or above Please upgrade to FortiWeb version 7.2.8 or above