CVE-2024-35278
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8 may allow an authenticated attacker
Severity
Medium 4.1
CVSS 3.1
Exploited
Not listed
EPSS
0.004
29.2th percentile
Discovered by
Not disclosed
Published
Jan 14, 2025
Assigned by fortinet
Description
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8 may allow an authenticated attacker to view the SQL query being run server-side when submitting an HTTP request, via including special elements in said request.
Weakness: CWE-89
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiPortal | Network & Security Management | cna-assigner |
Vendor-reported affected versions (1)
- Fortinet · FortiPortal
Vendor remediation
Please upgrade to FortiPortal version 7.4.0 or above Please upgrade to FortiPortal version 7.2.5 or above Please upgrade to FortiPortal version 7.0.9 or above