PT-2025-2439 · Fortinet · Fortiportal

Published 2025-01-14 · Updated 2025-01-14 · CVE-2024-35278

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Fortinet FortiPortal versions 7.0.0 through 7.2.8

Description: The issue is related to an improper neutralization of special elements used in an SQL command, also known as 'sql injection'. This may allow an authenticated attacker to view the SQL query being run server-side when submitting an HTTP request, by including special elements in the request.

Recommendations: For Fortinet FortiPortal versions 7.0.0 through 7.2.8, consider restricting access to the SQL query functionality until a patch is available. As a temporary workaround, avoid using special elements in HTTP requests to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-04331

CVE-2024-35278

Affected Products

Fortiportal

References · 5

• https://fortiguard.fortinet.com/psirt/FG-IR-24-086 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04331 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-35278 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35278 · Vendor Advisory
• https://twitter.com/CVEnew/status/1879174635578970550 · Twitter Post