Vulnerability · Published Mar 14, 2025 · Assigned by fortinet
CVE-2024-40590
Medium 4.4
In plain English
A medium-severity improper certificate validation in FortiPortal from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
An improper certificate validation vulnerability [CWE-295] in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, version 6.0.15 and below when connecting to a FortiManager device, a FortiAnalyzer device, or an SMTP server may allow an unauthenticated attacker in a Man-in-the-Middle position to intercept on and tamper with the encrypted communication channel established between the FortiPortal and those endpoints.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiPortal | 7.4.07.2.0 – through 7.2.47.0.0 – through 7.0.86.0.0 – through 6.0.15 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:R