CVE-2024-45329
A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.8 may allow an authenticated attacker to view un
Severity
Low 3.9
CVSS 3.1
Exploited
Not listed
EPSS
0.003
18.8th percentile
Discovered by
Not disclosed
Published
Jun 10, 2025
Assigned by fortinet
Description
A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.8 may allow an authenticated attacker to view unauthorized device information via key modification in API requests.
Weakness: CWE-639
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiPortal | Network & Security Management | cna-assigner |
Vendor-reported affected versions (1)
- Fortinet · FortiPortal
Vendor remediation
Please upgrade to FortiPortal version 7.4.1 or above Please upgrade to FortiPortal version 7.2.6 or above Please upgrade to FortiPortal version 7.0.9 or above