CVE-2024-23105

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allows an unauthenticated attack to bypass IP protection through crafted HTTP or HTTPS packets.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-348

Affected software

Vendor	Product	Versions
Fortinet	FortiPortal	>= 7.2.0, <= 7.2.1; >= 7.0.0, <= 7.0.6
fortinet	fortiportal	>= 7.0.0, <= 7.0.6
fortinet	fortiportal	>= 7.2.0, <= 7.2.1

References

https://fortiguard.com/psirt/FG-IR-24-021Vendor Advisory
https://fortiguard.com/psirt/FG-IR-24-021Vendor Advisory

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-231069.8An improper restriction of excessive authentication attempts [CWE-307] in FortiClientEMS version 7.2.0 through 7.2.4 and before 7.0.10 allow CVE-2024-231075.5An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, ve CVE-2024-231089.8An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to CVE-2024-231099.8An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to CVE-2024-23115.4The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including,CVE-2024-231107.8A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.CVE-2024-231114.8An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and CVE-2024-231124.3An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0 CVE-2024-231139.8A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, Fo CVE-2024-231149.8Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe de CVE-2024-231157.2Centreon updateGroups SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod CVE-2024-231167.2Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar