{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23669", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2024-01-19T08:23:28.613Z", "datePublished": "2024-06-05T07:45:35.018Z", "dateUpdated": "2024-06-05T14:11:01.521Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiWebManager", "defaultStatus": "unaffected", "versions": [{"version": "7.2.0", "status": "affected"}, {"versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.4", "status": "affected"}, {"version": "6.3.0", "status": "affected"}, {"versionType": "semver", "version": "6.2.3", "lessThanOrEqual": "6.2.4", "status": "affected"}, {"version": "6.0.2", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6.3.0 and 6.2.3 through 6.2.4 and 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-06-05T07:45:35.018Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:X/RC:X"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiWebManager version 7.4.0 or above \nPlease upgrade to FortiWebManager version 7.2.1 or above \nPlease upgrade to FortiWebManager version 7.0.5 or above \nPlease upgrade to FortiWebManager version 6.3.1 or above \nPlease upgrade to FortiWebManager version 6.2.5 or above \n"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"}]}, "adp": [{"affected": [{"vendor": "fortinet", "product": "fortiweb_manager", "cpes": ["cpe:2.3:a:fortinet:fortiweb_manager:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "7.2.0", "status": "affected"}, {"version": "7.0.0", "status": "affected", "lessThanOrEqual": "7.0.4", "versionType": "semver"}, {"version": "6.3.0", "status": "affected"}, {"version": "6.2.3", "status": "affected", "lessThanOrEqual": "6.2.4", "versionType": "semver"}, {"version": "6.0.2", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-05T14:06:39.473309Z", "id": "CVE-2024-23669", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-05T14:11:01.521Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiwebmanager:*:*:*:*:*:*:*:*", "matchCriteriaId": "C00F44FF-9533-4354-9060-A74E8F43E747", "versionEndExcluding": "6.2.5", "versionStartIncluding": "6.2.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiwebmanager:*:*:*:*:*:*:*:*", "matchCriteriaId": "403F07C3-8D48-4403-B9EE-0076F8639CB1", "versionEndExcluding": "7.0.5", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiwebmanager:6.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "6AB742D6-5B08-4FF7-A366-F4CE1E91C9A0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiwebmanager:6.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "A921BEEB-D912-471E-8176-8804F5CD5118", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiwebmanager:7.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "1C7475A8-52EB-413E-A196-6F43137B545F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6.3.0 and 6.2.3 through 6.2.4 and 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI."}, {"lang": "es", "value": "Una autorizaci\u00f3n inadecuada en Fortinet FortiWebManager versi\u00f3n 7.2.0 y 7.0.0 hasta 7.0.4 y 6.3.0 y 6.2.3 hasta 6.2.4 y 6.0.2 permite al atacante ejecutar c\u00f3digo o comandos no autorizados a trav\u00e9s de solicitudes HTTP o CLI."}], "id": "CVE-2024-23669", "lastModified": "2024-06-11T17:09:43.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@fortinet.com", "type": "Secondary"}]}, "published": "2024-06-05T08:15:09.537", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-222"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}