CVE-2024-40590 Information

Description

An improper certificate validation vulnerability [CWE-295] in FortiPortal version 7.4.0 version 7.2.4 and below version 7.0.8 and below version 6.0.15 and below when connecting to a FortiManager device a FortiAnalyzer device or an SMTP server may allow an unauthenticated attacker in a Man-in-the-Middle position to intercept on and tamper with the encrypted communication channel established between the FortiPortal and those endpoints.

Reference

https://fortiguard.fortinet.com/psirt/FG-IR-22-155