CVE-2024-31495
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6 and version 7.2.0 allows privileged user to obtain unauthori
Severity
Low 3.9
CVSS 3.1
Exploited
Not listed
EPSS
0.005
41.6th percentile
Discovered by
Not disclosed
Published
Jun 11, 2024
Assigned by fortinet
Description
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6 and version 7.2.0 allows privileged user to obtain unauthorized information via the report download functionality.
Weakness: CWE-89
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiPortal | Network & Security Management | cna-assigner |
Vendor-reported affected versions (3)
- Fortinet · FortiPortal
- fortinet · fortiportal
- fortinet · fortiportal
Vendor remediation
Please upgrade to FortiPortal version 7.2.1 or above Please upgrade to FortiPortal version 7.0.7 or above