FortiPortal vulnerabilities

6 known vulnerabilities in FortiPortal from Fortinet. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  FortiPortal: Improper Resolution of Path Equivalence

  CVE-2025-24470Feb 11, 2025FortinetEPSS 1.33%

  An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.11 may allow a remote unauthenticated attacker to retrieve source code via crafted HTTP requests.

• 9.8 Critical severity

  FortiManager: Missing Authentication for Critical Functionality

  CVE-2024-26011Nov 12, 2024Fortinet

  A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11, FortiManager 6.4.0 through 6.4.14, FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 throug

• 8.1 High severity

  FortiPortal: Authorization Bypass Through User-Controlled Key

  CVE-2023-47543Nov 12, 2024Fortinet

  An authorization bypass through user-controlled key vulnerability [CWE-639] in Fortinet FortiPortal version 7.0.0 through 7.0.3 allows an authenticated attacker to interact with ressources of other organizations via HTTP or HTTPS requests.

• 7.5 High severity

  FortiPortal: Use of Less Trusted Source

  CVE-2024-23105May 14, 2024Fortinet

  A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allows an unauthenticated attack to bypass IP protection through crafted HTTP or HTTPS packets.

• 8.8 High severity

  FortiPortal: Improper Access Control

  CVE-2023-46712Jan 10, 2024Fortinet

  A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attacker to escalate its privilege via specifically crafted HTTP requests.

• 8.8 High severity

  FortiPortal: Improper Neutralization of Special Elements used in a Command

  CVE-2023-48791Dec 13, 2023FortinetEPSS 1.26%

  An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in FortiPortal version 7.2.0, version 7.0.6 and below may allow a remote authenticated attacker with at least R/W permission to execute unauthorized c