CyberCVE

CVE-2024-35278

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8 may allow an authenticated attacker

Severity
Medium 4.1
CVSS 3.1
Exploited
Not listed
EPSS
0.004
31.1th percentile
Discovered by
Third party
Vendor advisory field
Published
Jan 14, 2025
Assigned by fortinet

Description

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8 may allow an authenticated attacker to view the SQL query being run server-side when submitting an HTTP request, via including special elements in said request.

Weakness: CWE-89

Affected products

Vendor Product Category Matched by
Fortinet FortiPortal Network & Security Management cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiPortal

Credit

Fortinet is pleased to thank David Cámara Galindo and Jose Catalan Tatay by Telefonica Tech for reporting this vulnerability under responsible disclosure.

Vendor remediation

Please upgrade to FortiPortal version 7.4.0 or above Please upgrade to FortiPortal version 7.2.5 or above Please upgrade to FortiPortal version 7.0.9 or above

References

Something wrong here?