CVE-2024-23105

A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allows an unauthenticated attack to bypass IP protection through crafted HTTP or HTTPS packets.

Scoring

Severity

HIGH

CVSS base score

7.1

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C

EPSS probability

0.45%

CWE

CWE-348

Published

2024-05-14

Last modified

2026-03-13

Affected products

• Fortinet FortiPortal
• Fortinet FortiPortal

Weakness type

• CWE-348

Related vulnerabilities

• CVE-2026-16272 — Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module
• CVE-2026-16732 — fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
• CVE-2026-25552 — Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header
• CVE-2026-63220 — CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
• CVE-2026-50243 — 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL
• CVE-2026-63770 — Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass
• CVE-2026-64619 — FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers
• CVE-2026-46415 — Caddy Defender trusted proxy client IP bypass

Markdown version · Browse all CVEs