An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and…
fortinet·CWE-286·Published 2025-04-08
An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard of other administrators via crafted requests.
An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard of other administrators via crafted requests.
Una vulnerabilidad de administración incorrecta de usuarios [CWE-286] en los widgets del panel de control de FortiWeb versión 7.6.2 y anteriores, versión 7.4.6 y anteriores, versión 7.2.10 y anteriores, versión 7.0.11 y anteriores puede permitir que un atacante autenticado con al menos permiso de administrador de solo lectura realice operaciones en el panel de control de otros administradores a través de solicitudes manipuladas.
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 3.1 | Primary | NVD | 7.2 | 1.2 | 5.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | Primary | cve.org | 5.6 | — | — | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H/E:P/RL:U/RC:R |
| 3.1 | Primary | cve.org | 5.6 | — | — | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H/E:P/RL:U/RC:R |
| 3.1 | Secondary | NVD | 6.2 | 0.7 | 5.5 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H |