CVE-2024-23107
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authent
Exploited
Not listed
EPSS
0.002
9.1th percentile
Discovered by
Vendor
Vendor advisory field
Published
Jun 3, 2024
Assigned by fortinet
Description
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authenticated attacker to read password hashes of other administrators via CLI commands.
Weakness: CWE-200
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiWeb Check your version | Web & Application Security | cna-assigner |
Vendor-reported products (2)
- Fortinet · FortiWeb
- fortinet · fortiweb
Credit
Internally discovered and reported by Kushal Arvind Shah of Fortinet's FortiGuard Labs.
Vendor remediation
Please upgrade to FortiWeb version 7.4.1 or above Please upgrade to FortiWeb version 7.2.5 or above Please upgrade to FortiWeb version 7.0.9 or above