CVE-2024-23665
First published: Mon Jun 03 2024(Updated: )
Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and below, version 6.4.3 and below, version 6.3.23 and below may allow an authenticated attacker to perform unauthorized ADOM operations via crafted requests.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiWeb | >=6.3.0<=6.3.23 | |
| Fortinet FortiWeb | >=6.4.0<=6.4.3 | |
| Fortinet FortiWeb | >=7.0.0<=7.0.10 | |
| Fortinet FortiWeb | >=7.2.0<7.2.8 | |
| Fortinet FortiWeb | >=7.4.0<7.4.3 |
Remedy
Please upgrade to FortiWeb version 7.4.3 or above Please upgrade to FortiWeb version 7.2.8 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-23665?
CVE-2024-23665 is considered a high-severity vulnerability due to its potential to allow unauthorized access to admin operations in FortiWeb.
How do I fix CVE-2024-23665?
To mitigate CVE-2024-23665, upgrade to FortiWeb version 7.4.3 or higher, 7.2.8 or higher, 7.0.11 or higher, or any version above 6.4.4.
What types of attacks are possible with CVE-2024-23665?
CVE-2024-23665 could allow authenticated attackers to perform unauthorized Administrative Domain (ADOM) operations via crafted requests.
Which versions of FortiWeb are affected by CVE-2024-23665?
FortiWeb versions 7.4.2 and below, 7.2.7 and below, 7.0.10 and below, 6.4.3 and below, and 6.3.23 and below are affected by CVE-2024-23665.
Is authentication required to exploit CVE-2024-23665?
Yes, exploitation of CVE-2024-23665 requires an authenticated user to carry out unauthorized operations.
- agent/weakness
- agent/remedy
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/source
- vendor/fortinet
- canonical/fortinet fortiweb
- version/fortinet fortiweb/6.3.0
- version/fortinet fortiweb/6.3.23
- version/fortinet fortiweb/6.4.0
- version/fortinet fortiweb/6.4.3
- version/fortinet fortiweb/7.0.0
- version/fortinet fortiweb/7.0.10
- version/fortinet fortiweb/7.2.0
- version/fortinet fortiweb/7.4.0