{"id":"CVE-2024-23670","aliases":["EUVD-2024-21143","GHSA-r6jx-8gj3-p962"],"status":"published","title":"An improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6...","description":"An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00443,"percentile":0.38761,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285"],"published":"2024-06-03T09:48:12Z","modified":"2026-07-08T14:16:51Z","products":[{"vendor":"fortinet","product":"fortiweb_manager"},{"vendor":"fortinet","product":"fortiwebmanager"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-23-222","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23670"},{"url":"https://github.com/advisories/GHSA-r6jx-8gj3-p962"}],"sources":{"cve":[{"id":"CVE-2024-23670","description":"An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.","status":"published","published":"2024-06-03T09:48:12.424Z","modified":"2026-07-08T13:03:45.905Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X","level":"high","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-21143","description":"An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.","status":"published","published":"2024-06-03T09:48:12Z","modified":"2026-07-08T13:03:45Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:X","level":"high"}],"updated_at":"2026-11-02T18:20:11.058935Z"}],"ghsa":[{"id":"GHSA-r6jx-8gj3-p962","title":"An improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6...","description":"An improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6.3.0 and 6.2.3 through 6.2.4 and 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.","status":"published","published":"2024-06-03T12:30:38Z","modified":"2024-06-03T12:30:45Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:57:24.376732Z"}],"nvd":[{"id":"CVE-2024-23670","description":"An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.","status":"published","published":"2024-06-03T10:15:13.523Z","modified":"2026-07-08T14:16:51.287Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:10:03.465199Z"}]}}