CVE-2024-46671

HIGH EPSS 31.3%

Published Apr 8, 20251y ago · Modified Jun 17, 20261w ago

7.2 CVSS 3.1

High

Published Apr 8, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

Description

An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard of other administrators via crafted requests.

CVSS Details

Base Score

7.2

Exploitability

1.2

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required High

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

31.3% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-286

Affected Products 3

Vendor	Product	Version	Range
fortinet	fortiweb	*	≥7.0.0 – <7.2.11
fortinet	fortiweb	*	≥7.4.0 – <7.4.7
fortinet	fortiweb	*	≥7.6.0 – <7.6.3

References 1

fortiguard.fortinet.com https://fortiguard.fortinet.com/psirt/FG-IR-24-184

Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.