CVE-2024-23104
Full vulnerability record from the local CVENow database.
Description
An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at least read-only permission on system maintenance to access backup information via crafted HTTP requests
Severity
MEDIUM
CVSS score
4.3
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-14 16:16:28.723000
Last modified
2026-11-08 20:10:00.187000
View original CVE JSON
{
"id": "CVE-2024-23104",
"sourceIdentifier": "[email protected]",
"published": "2026-04-14T16:16:28.723",
"lastModified": "2026-11-08T20:10:00.187",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at least read-only permission on system maintenance to access backup information via crafted HTTP requests"
},
{
"lang": "es",
"value": "Una vulnerabilidad de exposición de información sensible a un actor no autorizado en Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 hasta 7.4.8, FortiNDR 7.2 todas las versiones, FortiNDR 7.1 todas las versiones, FortiNDR 7.0 todas las versiones, FortiVoice 7.0.0 hasta 7.0.1 puede permitir a un atacante remoto autenticado con al menos permiso de solo lectura en el mantenimiento del sistema acceder a información de respaldo a través de solicitudes HTTP manipuladas."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Fortinet",
"product": "FortiVoice",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:fortivoice:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortivoice:7.0.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.0.0",
"lessThanOrEqual": "7.0.1",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Fortinet",
"product": "FortiNDR",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:fortindr:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.4.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.4.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.4.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortindr:7.0.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.6.0",
"status": "affected"
},
{
"version": "7.4.0",
"lessThanOrEqual": "7.4.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.2.0",
"lessThanOrEqual": "7.2.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.1.0",
"lessThanOrEqual": "7.1.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.0.0",
"lessThanOrEqual": "7.0.7",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-14T16:25:58.464987Z",
"id": "CVE-2024-23104",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.0",
"versionEndExcluding": "7.0.2",
"matchCriteriaId": "5F6B6495-7CF4-4E5A-8497-9AF6D81C083B"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.0",
"versionEndExcluding": "7.4.9",
"matchCriteriaId": "63871F8B-0798-4615-9781-9C7FA68C30AF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortindr:7.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9A1D8AE9-D9F9-402C-B8EB-58189200E0D6"
}
]
}
]
}
],
"references": [
{
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-124",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}