{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-08T22:04:03.048","vulnerabilities":[{"cve":{"id":"CVE-2024-35278","sourceIdentifier":"psirt@fortinet.com","published":"2025-01-14T14:15:30.280","lastModified":"2025-01-31T17:09:31.407","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8 may allow an authenticated attacker to view the SQL query being run server-side when submitting an HTTP request, via including special elements in said request."},{"lang":"es","value":"Una neutralización incorrecta de elementos especiales utilizados en un comando sql ('sql injection') en Fortinet FortiPortal versiones 7.2.4 a 7.2.0 y 7.0.0 a 7.2.8 puede permitir que un atacante autenticado vea la consulta SQL que se ejecuta en el servidor al enviar una solicitud HTTP, a través de elementos especiales incluida en dicha solicitud."}],"metrics":{"cvssMetricV31":[{"source":"psirt@fortinet.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"psirt@fortinet.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.9","matchCriteriaId":"EB9E106C-E997-40D4-B368-1E9554E5A9F7"},{"vulnerable":true,"criteria":"cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2.0","versionEndExcluding":"7.2.5","matchCriteriaId":"324378D9-B66F-490A-A3D6-96C05E13F0A0"}]}]}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-086","source":"psirt@fortinet.com","tags":["Vendor Advisory"]}]}}]}