A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8 may allow an authenticated attacker to view the SQL query being run server-side when submitting an HTTP request, via including special elements in said request.
References
| Link | Resource |
|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-24-086 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
31 Jan 2025, 17:09
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:* | |
| References | () https://fortiguard.fortinet.com/psirt/FG-IR-24-086 - Vendor Advisory | |
| First Time |
Fortinet
Fortinet fortiportal |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
14 Jan 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-01-14 14:15
Updated : 2025-01-31 17:09
NVD link : CVE-2024-35278
Mitre link : CVE-2024-35278
JSON object : View
Products Affected
fortinet
- fortiportal
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')