CyberCVE

CVE-2024-46671

An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an aut

Severity
Medium 5.6
CVSS 3.1
Exploited
Not listed
EPSS
0.004
37.8th percentile
Discovered by
Third party
Vendor advisory field
Published
Apr 8, 2025
Assigned by fortinet

Description

An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard of other administrators via crafted requests.

Weakness: CWE-286

Affected products

Vendor Product Category Matched by
Fortinet FortiWeb Web & Application Security cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiWeb

Credit

Fortinet is pleased to thank Islem MEGHNINE and Mohamed Amine ZERIAT for reporting this vulnerability under responsible disclosure.

Vendor remediation

Please upgrade to FortiWeb version 7.6.3 or above Please upgrade to FortiWeb version 7.4.7 or above Please upgrade to FortiWeb version 7.2.11 or above

References

Something wrong here?