CVE-2024-21761
An improper authorization vulnerability [CWE-285] in FortiPortal version 7.2.0, and versions 7.0.6 and below reports may allow a user to download other organizations reports via modification in the re
Severity
Low 3.9
CVSS 3.1
Exploited
Not listed
EPSS
0.004
37.1th percentile
Discovered by
Third party
Vendor advisory field
Published
Mar 12, 2024
Assigned by fortinet
Description
An improper authorization vulnerability [CWE-285] in FortiPortal version 7.2.0, and versions 7.0.6 and below reports may allow a user to download other organizations reports via modification in the request payload.
Weakness: CWE-285
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiPortal | Network & Security Management | cna-assigner |
Vendor-reported products (3)
- Fortinet · FortiPortal
- fortinet · fortiportal
- fortinet · fortiportal
Credit
External
Vendor remediation
Please upgrade to FortiPortal version 7.2.1 or above Please upgrade to FortiPortal version 7.0.7 or above