CVE-2024-45329

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.8 may allow an authenticated attacker to view unauthorized device information via key modification in API requests.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Jun 10, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-45336.5The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a SQL statement, allowCVE-2024-453307.2A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to CVE-2024-453317.8A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzCVE-2024-453325.6Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect brCVE-2024-453337.3Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 may allow an authenticCVE-2024-453347.8Trend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary Configuration Update that could allow unauthoriCVE-2024-453355.5Trend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an attacker to use a specifically crafted viruCVE-2024-453366.1The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an AuthorizatioCVE-2024-453379.1Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptibleCVE-2024-453385.3An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremelCVE-2024-453397.1When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file patCVE-2024-45346.1The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing sanitisation as well as es
CVE-2024-45329: Medium severity, CVSS 4.3 | Vulnix