CyberCVE

CVE-2024-23104

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0

Severity
Medium 5.4
CVSS 3.1
Exploited
Not listed
EPSS
0.003
17.0th percentile
Discovered by
Not disclosed
Published
Apr 14, 2026
Assigned by fortinet

Description

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at least read-only permission on system maintenance to access backup information via crafted HTTP requests

Weakness: CWE-200

Affected products

Vendor Product Category Matched by
Fortinet FortiNDR Threat Detection & Sandbox cna-assigner
Fortinet FortiVoice Other Products cna-assigner
Vendor-reported affected versions (2)
  • Fortinet · FortiVoice
  • Fortinet · FortiNDR

Vendor remediation

Upgrade to FortiVoice version 7.0.2 or above Upgrade to FortiVoice version 6.4.9 or above Upgrade to FortiNDR version 7.6.1 or above Upgrade to FortiNDR version 7.4.9 or above

References