CyberCVE

CVE-2024-46671

An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an aut

Severity
Medium 5.6
CVSS 3.1
Remote, needs privileges or user interaction what this means
Exploited
Not listed
EPSS
0.004
36.2th percentile
Discovered by
Third party
Vendor advisory field
Published
Apr 8, 2025
Assigned by fortinet

Description

An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard of other administrators via crafted requests.

Weakness: CWE-286

Affected products

Vendor Product Category Matched by
Fortinet FortiWeb Check your version Web & Application Security cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiWeb

Credit

Fortinet is pleased to thank Islem MEGHNINE and Mohamed Amine ZERIAT for reporting this vulnerability under responsible disclosure.

Vendor remediation

Please upgrade to FortiWeb version 7.6.3 or above Please upgrade to FortiWeb version 7.4.7 or above Please upgrade to FortiWeb version 7.2.11 or above

References

Something wrong here?