CVE-2024-47570

Published: Dec 9, 2025Modified: Oct 2, 2026

6.6

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.7 / Impact: 5.9

Source: NVD

Description

An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.11; FortiPAM 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiSRA 1.4 all versions may allow a read-only administrator to retrieve API tokens of other administrators via observing REST API logs, if REST API logging is enabled (non-default configuration).

Affected (8)

Products: Fortinet: Fortios, Fortipam, Fortiproxy, Fortisase, Fortisra

5 products

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortios	7.0.4 ≤ version ≤ 7.0.17
Fortinet Fortios	7.2.0 ≤ version < 7.2.8
Fortinet Fortios	7.4.0 ≤ version < 7.4.4
Fortinet Fortipam	1.0.0 ≤ version ≤ 1.4.3
Fortinet Fortiproxy	7.2.0 ≤ version < 7.2.12
Fortinet Fortiproxy	7.4.0 ≤ version < 7.4.4
Fortinet Fortisase	Version 24.1.37
Fortinet Fortisra	1.4.0 ≤ version ≤ 1.4.3

Related CWEs

CWE-532

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (1)

https://fortiguard.fortinet.com/psirt/FG-IR-24-268

Source: psirt@fortinet.com

Vendor Advisory

Timeline

No history available yet.