PT-2025-2439 · Fortinet · Fortiportal

Publicado 2025-01-14 · Atualizado 2025-01-14 · CVE-2024-35278

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Fortinet FortiPortal versions 7.0.0 through 7.2.8

Description: The issue is related to an improper neutralization of special elements used in an SQL command, also known as 'sql injection'. This may allow an authenticated attacker to view the SQL query being run server-side when submitting an HTTP request, by including special elements in the request.

Recommendations: For Fortinet FortiPortal versions 7.0.0 through 7.2.8, consider restricting access to the SQL query functionality until a patch is available. As a temporary workaround, avoid using special elements in HTTP requests to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2025-04331

CVE-2024-35278

Produtos afetados

Fortiportal

Referências · 5

• https://fortiguard.fortinet.com/psirt/FG-IR-24-086 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1879174635578970550 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2025-04331 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2024-35278 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2024-35278 · Aviso do Fabricante