CyberCVE

CVE-2024-23662

An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.15 and 6.4.0 through 6.4.1

Severity
Medium 5
CVSS 3.1
Exploited
Not listed
EPSS
0.007
51.6th percentile
Discovered by
Third party
Vendor advisory field
Published
Apr 9, 2024
Assigned by fortinet

Description

An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.15 and 6.4.0 through 6.4.15 allows attacker to information disclosure via HTTP requests.

Weakness: CWE-200

Affected products

Vendor Product Category Matched by
Fortinet FortiOS Firewall / NGFW cna-assigner
Vendor-reported products (2)
  • Fortinet · FortiOS
  • fortinet · fortios

Credit

Fortinet is pleased to thank security researcher Andreas Korpås at Institute for Energy Technology SOC for discovering and reporting this vulnerability under responsible disclosure.

Vendor remediation

Please upgrade to FortiOS version 7.4.2 or above Please upgrade to FortiOS version 7.2.6 or above

References

Something wrong here?