CVE-2024-40590CWE-295

An improper certificate validation vulnerability [CWE-295] in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, version 6.0.15 and…

Medium · published March 14, 2025

CVSS v3.1
4.4
EPSS
0%
Percentile
5.4
In the wild
Unconfirmed
What it is

An improper certificate validation vulnerability [CWE-295] in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, version 6.0.15 and below when connecting to a FortiManager device, a FortiAnalyzer device, or an SMTP server may allow an unauthenticated attacker in a Man-in-the-Middle position to intercept on and tamper with the encrypted communication channel established between the FortiPortal and those endpoints.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:R
CVSS v4.0
Not supplied
EPSS
0.00164 · 5.4th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2025-03-14T15:02Z
EPSS history
Timeline
  • 14 MAR 15:02Z
    An improper certificate validation vulnerability [CWE-295] in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, version 6.0.15 and…
    cvelistv5