---
id: CVE-2024-23669
title: >-
  An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager
  7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through
  6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or
  commands …
summary: >-
  An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager
  7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through
  6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or
  commands …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-20
  - CWE-863
vendor: fortinet
product: fortiwebmanager
affected:
  - 'fortiwebmanager >= 6.2.3, < 6.2.5'
  - 'fortiwebmanager >= 7.0.0, < 7.0.5'
  - fortiwebmanager = 6.0.2
  - fortiwebmanager = 6.3.0
  - fortiwebmanager = 7.2.0
patched:
  - fortiwebmanager 7.0.5
published: '2024-06-05'
updated: '2026-07-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-23669'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-23-222'
    label: psirt@fortinet.com
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-23-222'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00547
epssPercentile: 0.4336
ingestedAt: '2026-07-08T14:51:15.594Z'
---

## Overview

An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.

## Affected

- `fortiwebmanager >= 6.2.3, < 6.2.5`
- `fortiwebmanager >= 7.0.0, < 7.0.5`
- `fortiwebmanager = 6.0.2`
- `fortiwebmanager = 6.3.0`
- `fortiwebmanager = 7.2.0`

## Remediation

Upgrade past the affected range:

- `fortiwebmanager 7.0.5`