{"id":"CVE-2024-31495","state":"PUBLISHED","title":"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6 and version 7.2.0 allows privileged user","description":"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6 and version 7.2.0 allows privileged user to obtain unauthorized information via the report download functionality.","publishedAt":"2024-06-11T14:31:58.370Z","updatedAt":"2024-08-02T01:52:57.311Z","severity":{"score":3.9,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiPortal"],"affected":[{"vendor":"Fortinet","product":"FortiPortal","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.6","versionType":"semver"}]}],"references":["https://fortiguard.fortinet.com/psirt/FG-IR-24-128"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:07:21.467Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/31xxx/CVE-2024-31495.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-31495","state":"PUBLISHED","datePublished":"2024-06-11T14:31:58.370Z","dateUpdated":"2024-08-02T01:52:57.311Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2024-04-04T12:52:41.587Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6 and version 7.2.0 allows privileged user to obtain unauthorized information via the report download functionality."}],"affected":[{"vendor":"Fortinet","product":"FortiPortal","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.6","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-128","name":"https://fortiguard.fortinet.com/psirt/FG-IR-24-128"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.9,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","lang":"en","description":"Execute unauthorized code or commands","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2024-06-11T14:31:58.370Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiPortal version 7.2.1 or above \nPlease upgrade to FortiPortal version 7.0.7 or above \n"}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"fortinet","product":"fortiportal","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"}],"cpes":["cpe:2.3:a:fortinet:fortiportal:7.2.0:*:*:*:*:*:*:*"]},{"vendor":"fortinet","product":"fortiportal","defaultStatus":"unaffected","versions":[{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.6","versionType":"custom"}],"cpes":["cpe:2.3:a:fortinet:fortiportal:7.0.0:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-11T16:41:37.631630Z","id":"CVE-2024-31495","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-11T16:43:59.236Z"}},{"title":"CVE Program Container","references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-128","name":"https://fortiguard.fortinet.com/psirt/FG-IR-24-128","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T01:52:57.311Z"}}]}}}