Sensitive Information Exposure via Crafted HTTP Requests in FortiNDR and FortiVoice
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Fortinet | FortiVoice | unaffected |
|
||||||||||||||||||
| Fortinet | FortiNDR | unaffected |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
No data.
| Vendor | Product | Versions | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Fortinet | Fortindr |
|
||||||||||||||||||||||||
| Fortinet | Fortivoice |
|
Vendor Solution
Upgrade to FortiVoice version 7.0.2 or above Upgrade to FortiVoice version 6.4.9 or above Upgrade to FortiNDR version 7.6.1 or above Upgrade to FortiNDR version 7.4.9 or above
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.265% probability within 30 days)
| Link | Providers |
|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-26-124 |
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:* |
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Sensitive Information Exposure via Crafted HTTP Requests in FortiNDR and FortiVoice |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at least read-only permission on system maintenance to access backup information via crafted HTTP requests | |
| First Time appeared |
Fortinet
Fortinet fortindr Fortinet fortivoice |
|
| Weaknesses | CWE-200 | |
| CPEs | cpe:2.3:a:fortinet:fortindr:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.0.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.0.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.1.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.1.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.2.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.2.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.4.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.4.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.4.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.4.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.4.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.4.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.4.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.4.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.4.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortindr:7.6.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortivoice:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortivoice:7.0.1:*:*:*:*:*:*:* |
|
| Vendors & Products |
Fortinet
Fortinet fortindr Fortinet fortivoice |
|
| References |
| |
| Metrics |
cvssV3_1
|