PT-2024-19041 · Fortinet · Fortiportal

Published 2024-03-12 · Updated 2024-03-21 · CVE-2024-21761

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiPortal versions 7.0.6 and below FortiPortal version 7.2.0

Description An improper authorization issue in FortiPortal may allow a user to download other organizations' reports via modification in the request payload. This issue could potentially be exploited by modifying the request to access unauthorized data.

Recommendations For FortiPortal versions 7.0.6 and below, update to a version above 7.0.6 to resolve the issue. For FortiPortal version 7.2.0, update to a version above 7.2.0 to resolve the issue. As a temporary workaround, consider restricting access to the report download functionality to minimize the risk of exploitation.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-21761

Affected Products

Fortiportal

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-21761 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21761 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-24-016 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1767596436110114926 · Twitter Post
• https://t.me/cvenotify/74370 · Telegram Post
• https://twitter.com/CVEnew/status/1767570066801934481 · Twitter Post