CVE-2024-23668: Input Validation
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiWebManagerto a version that resolves this vulnerability.Fixed in 6.2.5 - Upgrade
Upgrade
Fortinet FortiWebManagerto a version that resolves this vulnerability.Fixed in 6.3.1 - Upgrade
Upgrade
Fortinet FortiWebManagerto a version that resolves this vulnerability.Fixed in 7.0.5 - Upgrade
Upgrade
Fortinet FortiWebManagerto a version that resolves this vulnerability.Fixed in 7.2.1 - Upgrade
Upgrade
Fortinet FortiWebManagerto a version that resolves this vulnerability.Fixed in 7.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23668?
CVE-2024-23668 is considered a high-severity vulnerability due to improper authorization allowing attackers to execute unauthorized commands.
How do I fix CVE-2024-23668?
To remediate CVE-2024-23668, upgrade to FortiWebManager version 7.2.1 or later, or apply the appropriate patches as specified by Fortinet.
Which versions of FortiWebManager are affected by CVE-2024-23668?
CVE-2024-23668 affects FortiWebManager versions 6.0.2, 6.2.3 to 6.2.4, 7.0.0 to 7.0.4, and 7.2.0.
What types of attacks are possible with CVE-2024-23668?
CVE-2024-23668 allows attackers to issue unauthorized commands via HTTP requests or command-line interface, potentially compromising the system.
Is CVE-2024-23668 a remote exploitation vulnerability?
Yes, CVE-2024-23668 can be exploited remotely through the web interface or CLI of the affected FortiWebManager versions.