CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-21759
https://notcve.org/view.php?id=CVE-2024-21759
An authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7.0.6 allows attacker to view unauthorized resources via HTTP or HTTPS requests. • https://fortiguard.fortinet.com/psirt/FG-IR-24-011 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-31495
https://notcve.org/view.php?id=CVE-2024-31495
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6 and version 7.2.0 allows privileged user to obtain unauthorized information via the report download functionality. Una neutralización inadecuada de elementos especiales utilizados en un comando sql ("inyección sql") en las versiones 7.0.0 a 7.0.6 y 7.2.0 de Fortinet FortiPortal permite a un usuario privilegiado obtener información no autorizada a través de la funcionalidad de descarga de informes. • https://fortiguard.fortinet.com/psirt/FG-IR-24-128 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-48789
https://notcve.org/view.php?id=CVE-2023-48789
A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access control via crafted HTTP requests. Una aplicación de la seguridad del lado del servidor en Fortinet FortiPortal versión 6.0.0 a 6.0.14 permite al atacante realizar un control de acceso inadecuado a través de solicitudes HTTP manipuladas. • https://fortiguard.fortinet.com/psirt/FG-IR-23-406 • CWE-602: Client-Side Enforcement of Server-Side Security •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-23105
https://notcve.org/view.php?id=CVE-2024-23105
A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allows an unauthenticated attack to bypass IP protection through crafted HTTP or HTTPS packets. Una vulnerabilidad de uso de fuente menos confiable [CWE-348] en Fortinet FortiPortal versión 7.0.0 a 7.0.6 y versión 7.2.0 a 7.2.1 permite que un ataque no autenticado evite la protección IP a través de paquetes HTTP o HTTPS manipulados. • https://fortiguard.com/psirt/FG-IR-24-021 • CWE-348: Use of Less Trusted Source •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-21761
https://notcve.org/view.php?id=CVE-2024-21761
An improper authorization vulnerability [CWE-285] in FortiPortal version 7.2.0, and versions 7.0.6 and below reports may allow a user to download other organizations reports via modification in the request payload. Una vulnerabilidad de autorización inadecuada [CWE-285] en los informes de FortiPortal versión 7.2.0 y versiones 7.0.6 e inferiores puede permitir a un usuario descargar informes de otras organizaciones mediante modificaciones en el payload de la solicitud. • https://fortiguard.com/psirt/FG-IR-24-016 • CWE-285: Improper Authorization •