CVE-2024-46671

An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard of other administrators via crafted requests.

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

6.2 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H

EPSS

0.42% chance of exploitation in the next 30 days, 35th percentile

Published

2025-04-08

Proof-of-concept exploits (1)

• ixec-lab/fortinet-cve-2024-46671

References

• CVE Record
• NVD entry

Related

• CVE-2024-46658
• CVE-2024-4672
• CVE-2024-46654
• CVE-2024-4673
• CVE-2024-4665
• CVE-2024-4674