CVE-2024-47570
An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.11;
Description
An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.11; FortiPAM 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiSRA 1.4 all versions may allow a read-only administrator to retrieve API tokens of other administrators via observing REST API logs, if REST API logging is enabled (non-default configuration).
Weakness: CWE-532
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiOS | Firewall / NGFW | cna-assigner |
| Fortinet | FortiPAM | Identity / IAM / MFA | cna-assigner |
| Fortinet | FortiProxy | SASE / SSE / Secure Web | cna-assigner |
| Fortinet | FortiSASE | SASE / SSE / Secure Web | cna-assigner |
| Fortinet | FortiSRA | VPN & Remote Access | cna-assigner |
Vendor-reported products (5)
- Fortinet · FortiSASE
- Fortinet · FortiProxy
- Fortinet · FortiSRA
- Fortinet · FortiPAM
- Fortinet · FortiOS
Credit
Internally discovered and reported by Justin Lum of Fortinet development team.
Vendor remediation
Fortinet remediated this issue in FortiSASE version 24.1.c and hence customers do not need to perform any action. Upgrade to FortiProxy version 7.4.4 or above Upgrade to FortiProxy version 7.2.12 or above Upgrade to FortiSRA version 1.6.0 or above Upgrade to FortiSRA version 1.5.0 or above Upgrade to FortiPAM version 1.6.0 or above Upgrade to FortiPAM version 1.5.0 or above Upgrade to FortiOS version 7.6.0 or above Upgrade to FortiOS version 7.4.4 or above Upgrade to FortiOS version 7.2.8 or above