Description (CNA)
An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.11; FortiPAM 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiSRA 1.4 all versions may allow a read-only administrator to retrieve API tokens of other administrators via observing REST API logs, if REST API logging is enabled (non-default configuration).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Fortinet / FortiSASE | affected 24.1.10 |
| Fortinet / FortiProxy | affected 7.4.0 through 7.4.3; affected 7.2.0 through 7.2.11 |
| Fortinet / FortiSRA | affected 1.4.0 through 1.4.3 |
| Fortinet / FortiPAM | affected 1.4.0 through 1.4.3; affected 1.3.0 through 1.3.1; affected 1.2.0; affected 1.1.0 through 1.1.2; affected 1.0.0 through 1.0.3 |
| Fortinet / FortiOS | affected 7.4.0 through 7.4.3; affected 7.2.0 through 7.2.7; affected 7.0.4 through 7.0.18 |
CWE
CWE-532
References
ADP enrichment
No English description supplied.
No references supplied.