CVE-2024-45329 | THREATINT

Description

A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.8 may allow an authenticated attacker to view unauthorized device information via key modification in API requests.

PUBLISHED Reserved 2024-08-27 | Published 2025-06-10 | Updated 2025-06-10 | Assigner fortinet

LOW: 3.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

Problem types

Improper access control

Product status

Default status

unaffected

7.4.0

affected

7.2.0 (semver)

affected

7.0.0 (semver)

affected

References

fortiguard.fortinet.com/psirt/FG-IR-24-274

cve.org (CVE-2024-45329)

nvd.nist.gov (CVE-2024-45329)