CVE-2024-47570
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A vulnerability in FortiOS, FortiProxy, FortiPAM, and FortiSRA involves insertion of sensitive information into log files. A read-only administrator can retrieve API tokens of other administrators by observing REST API logs, if REST API logging is enabled (non-default configuration).
Risk Assessment
The risk includes unauthorized access to API tokens, which could lead to account takeover and compromise of the entire infrastructure.
Recommendation
It is recommended to disable REST API logging if not required, and restrict log access to trusted administrators. Also consider upgrading to a patched version.
Other vulnerabilities in FortiOS
See all- CVE-2015-7361High
FortiOS version 5.2.3, when configured for High Availability (HA) with the dedicated management interface enabled, does not require authentication for access to the ZebOS shell on this interface. This allows remote attackers to gain shell access via unspecified vectors.
- CVE-2025-68686MediumActively exploited
A vulnerability in Fortinet FortiOS allows a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases. The attack requires prior compromise of the product via another vulnerability at the filesystem level.
- CVE-2025-24472HighActively exploited
An authentication bypass vulnerability in FortiOS and FortiProxy allows a remote unauthenticated attacker, with prior knowledge of upstream and downstream device serial numbers, to gain super-admin privileges on the downstream device if Security Fabric is enabled. The attack is carried out via crafted CSF proxy requests.
- CVE-2024-55591CriticalActively exploited
An authentication bypass vulnerability in FortiOS and FortiProxy using an alternate path or channel. A remote attacker can gain super-admin privileges by sending crafted requests to the Node.js websocket module.
- CVE-2023-42789Critical
An out-of-bounds write vulnerability in Fortinet FortiOS, FortiProxy, and FortiSASE allows an attacker to execute unauthorized code or commands via specially crafted HTTP requests.
- CVE-2022-40684CriticalActively exploited
An authentication bypass vulnerability in FortiOS, FortiProxy, and FortiSwitchManager allows an unauthenticated attacker to perform operations on the administrative interface via crafted HTTP or HTTPS requests.
- CVE-2021-44168LowActively exploited
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
- CVE-2019-5591MediumActively exploited
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
- CVE-2020-12812CriticalActively exploited
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
- CVE-2019-6693MediumActively exploited
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
Original NVD description (English source)
An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.11; FortiPAM 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiSRA 1.4 all versions may allow a read-only administrator to retrieve API tokens of other administrators via observing REST API logs, if REST API logging is enabled (non-default configuration).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS