CVE-2024-23104

Sensitive Information Exposure via Crafted HTTP Requests in FortiNDR and FortiVoice

Published Apr 14, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at least read-only permission on system maintenance to access backup information via crafted HTTP requests

Remediation

Vendor Solution

Upgrade to FortiVoice version 7.0.2 or above Upgrade to FortiVoice version 6.4.9 or above Upgrade to FortiNDR version 7.6.1 or above Upgrade to FortiNDR version 7.4.9 or above

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Title Sensitive Information Exposure via Crafted HTTP Requests in FortiNDR and FortiVoice
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at least read-only permission on system maintenance to access backup information via crafted HTTP requests
First Time appeared Fortinet
Fortinet fortindr
Fortinet fortivoice
Weaknesses CWE-200
CPEs cpe:2.3:a:fortinet:fortindr:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.1.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.1.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:7.0.1:*:*:*:*:*:*:*
Vendors & Products Fortinet
Fortinet fortindr
Fortinet fortivoice
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
fortinet
Published
Updated
Apr 14, 2026, 4:46 PM
Reserved
Jan 11, 2024, 4:29 PM
Status
Analyzed
Published
Apr 14, 2026, 4:16 PM
Modified
Nov 8, 2026, 8:10 PM