CVE-2024-40590

Summary

CVE-2024-40590 is a newly disclosed vulnerability affecting FortiPortal versions 7.4.0, 7.2.4 and below, 7.0.8 and below, and 6.0.15 and below. This issue, classified as CWE-295, involves an improper certificate validation issue. When connecting to a FortiManager device, FortiAnalyzer device, or an SMTP server, an unauthenticated attacker in a Man-in-the-Middle (MitM) position can intercept and tamper with the encrypted communication channel between FortiPortal and these endpoints, posing a significant risk to data integrity and confidentiality.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.