CVE-2024-23104
Received Received - Intake
Information Disclosure in Fortinet FortiNDR and FortiVoice

Publication date: 2026-04-14

Last updated on: 2026-04-20

Assigner: Fortinet, Inc.

Description
An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at least read-only permission on system maintenance to access backup information via crafted HTTP requests
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-14
Last Modified
2026-04-20
Generated
2026-06-16
AI Q&A
2026-04-15
EPSS Evaluated
2026-06-14
NVD
CVE-2024-23104
EUVD
EUVD-2024-20629
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
fortinet fortivoice From 7.0.0 (inc) to 7.0.2 (exc)
fortinet fortindr 7.6.0
fortinet fortindr From 7.0.0 (inc) to 7.4.9 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

This vulnerability involves the exposure of sensitive information to an unauthorized actor, which could potentially lead to non-compliance with data protection regulations such as GDPR and HIPAA. Unauthorized access to backup information may result in the compromise of personal or protected health information, thereby violating confidentiality requirements mandated by these standards.

However, specific impacts on compliance depend on the nature of the exposed data and the organization's mitigation measures.

Executive Summary

This vulnerability involves the exposure of sensitive information in Fortinet FortiNDR and FortiVoice products. A remote authenticated attacker who has at least read-only permission on system maintenance can exploit this issue by sending specially crafted HTTP requests to access backup information that should be protected.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive backup information. This could potentially allow attackers to gain insights into system configurations or sensitive data stored in backups, which may be used for further attacks or unauthorized access.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-23104. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart