CVE-2024-23104

Received Received - Intake

Information Disclosure in Fortinet FortiNDR and FortiVoice

Publication date: 2026-04-14

Last updated on: 2026-04-20

Assigner: Fortinet, Inc.

Description

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at least read-only permission on system maintenance to access backup information via crafted HTTP requests

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-14

Last Modified

2026-04-20

Generated

2026-07-06

AI Q&A

2026-04-14

EPSS Evaluated

2026-07-05

NVD

CVE-2024-23104

EUVD

EUVD-2024-20629

Affected Vendors & Products

Vendor	Product	Version / Range
fortinet	fortivoice	From 7.0.0 (inc) to 7.0.2 (exc)
fortinet	fortindr	7.6.0
fortinet	fortindr	From 7.0.0 (inc) to 7.4.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability involves the exposure of sensitive information in Fortinet FortiNDR and FortiVoice products. A remote authenticated attacker who has at least read-only permission on system maintenance can exploit this issue by sending specially crafted HTTP requests to access backup information that should be protected.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive backup information. This could potentially allow attackers to gain insights into system configurations or sensitive data stored in backups, which may be used for further attacks or unauthorized access.

Compliance Impact

This vulnerability involves the exposure of sensitive information to an unauthorized actor, which could potentially lead to non-compliance with data protection regulations such as GDPR and HIPAA. Unauthorized access to backup information may result in the compromise of personal or protected health information, thereby violating confidentiality requirements mandated by these standards.

However, specific impacts on compliance depend on the nature of the exposed data and the organization's mitigation measures.

Hi! I’m here to help you understand CVE-2024-23104. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70