CyberCVE

CVE-2024-23104

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0

Severity
Medium 5.4
CVSS 3.1
Exploited
Not listed
EPSS
0.003
17.5th percentile
Discovered by
Vendor
Vendor advisory field
Published
Apr 14, 2026
Assigned by fortinet

Description

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at least read-only permission on system maintenance to access backup information via crafted HTTP requests

Weakness: CWE-200

Affected products

Vendor Product Category Matched by
Fortinet FortiNDR Threat Detection & Sandbox cna-assigner
Fortinet FortiVoice Other Products cna-assigner
Vendor-reported products (2)
  • Fortinet · FortiVoice
  • Fortinet · FortiNDR

Credit

Internally discovered and reported by Yonghui Han of Fortinet Product Security team.

Vendor remediation

Upgrade to FortiVoice version 7.0.2 or above Upgrade to FortiVoice version 6.4.9 or above Upgrade to FortiNDR version 7.6.1 or above Upgrade to FortiNDR version 7.4.9 or above

References

Something wrong here?