{"id":"CVE-2024-31490","aliases":["EUVD-2024-29370","GHSA-q6gr-fq83-8hmc"],"status":"published","title":"An exposure of sensitive information to an unauthorized actor in Fortinet FortiSandbox version 4...","description":"An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2.2 through 3.2.4, FortiSandbox 3.1.5 allows attacker to information disclosure via HTTP get requests.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00454,"percentile":0.3987,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2024-09-10T14:37:45Z","modified":"2026-06-17T07:28:32Z","products":[{"vendor":"fortinet","product":"fortisandbox"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-24-051","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31490"},{"url":"https://github.com/advisories/GHSA-q6gr-fq83-8hmc"}],"sources":{"cve":[{"id":"CVE-2024-31490","description":"An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2.2 through 3.2.4, FortiSandbox 3.1.5 allows attacker to information disclosure via HTTP get requests.","status":"published","published":"2024-09-10T14:37:45.103Z","modified":"2026-01-14T13:46:57.324Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:14.308905Z"}],"euvd":[{"id":"EUVD-2024-29370","description":"An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2.2 through 3.2.4, FortiSandbox 3.1.5 allows attacker to information disclosure via HTTP get requests.","status":"published","published":"2024-09-10T14:37:45Z","modified":"2026-01-14T13:46:57Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X","level":"medium"}],"updated_at":"2026-11-02T19:48:52.227329Z"}],"ghsa":[{"id":"GHSA-q6gr-fq83-8hmc","title":"An exposure of sensitive information to an unauthorized actor in Fortinet FortiSandbox version 4...","description":"An exposure of sensitive information to an unauthorized actor in Fortinet FortiSandbox version 4.4.0 through 4.4.4 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.2 through 3.2.4 and 3.1.5 allows attacker to information disclosure via HTTP get requests.","status":"published","published":"2024-09-10T15:31:05Z","modified":"2024-09-10T15:31:11Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:58:13.090684Z"}],"nvd":[{"id":"CVE-2024-31490","description":"An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2.2 through 3.2.4, FortiSandbox 3.1.5 allows attacker to information disclosure via HTTP get requests.","status":"published","published":"2024-09-10T15:15:15.983Z","modified":"2026-06-17T07:28:32.243Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:10:25.561537Z"}]}}