CVE-2024-31495
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6 and version 7.2.0 allows privileged user to obtain unauthori
Severity
Low 3.9
CVSS 3.1
Exploited
Not listed
EPSS
0.005
43.6th percentile
Discovered by
Third party
Vendor advisory field
Published
Jun 11, 2024
Assigned by fortinet
Description
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6 and version 7.2.0 allows privileged user to obtain unauthorized information via the report download functionality.
Weakness: CWE-89
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiPortal | Network & Security Management | cna-assigner |
Vendor-reported products (3)
- Fortinet · FortiPortal
- fortinet · fortiportal
- fortinet · fortiportal
Credit
Fortinet is pleased to thank David Cmara Galindo and Jose Catalan Tatay from Telefonica Tech for bringing this issue to our attention under responsible disclosure.
Vendor remediation
Please upgrade to FortiPortal version 7.2.1 or above Please upgrade to FortiPortal version 7.0.7 or above