BaseFortify

Publication date: 2025-12-09

Last updated on: 2025-12-10

Assigner: Fortinet, Inc.

Description

An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.11; FortiPAM 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiSRA 1.4 all versions may allow a read-only administrator to retrieve API tokens of other administrators via observing REST API logs, if REST API logging is enabled (non-default configuration).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-09

Last Modified

2025-12-10

Generated

2026-07-07

AI Q&A

2025-12-09

EPSS Evaluated

2026-07-05

NVD

CVE-2024-47570

Affected Vendors & Products

Vendor	Product	Version / Range
fortinet	fortiproxy	7.2.1
fortinet	fortios	7.2.1
fortinet	fortiproxy	7.2.3
fortinet	fortiproxy	7.2.7
fortinet	fortios	7.2.3
fortinet	fortios	7.2.7
fortinet	fortios	7.4.2
fortinet	fortiproxy	7.4.1
fortinet	fortipam	1.1
fortinet	fortios	7.2.4
fortinet	fortiproxy	7.2.2
fortinet	fortios	7.4.0
fortinet	fortipam	1.4
fortinet	fortiproxy	7.2.0
fortinet	fortiproxy	7.4.2
fortinet	fortiproxy	7.4.0
fortinet	fortiproxy	7.2.4
fortinet	fortipam	1.0
fortinet	fortisra	1.4
fortinet	fortiproxy	7.4.3
fortinet	fortipam	1.2
fortinet	fortiproxy	7.2.6
fortinet	fortiproxy	7.2.5
fortinet	fortios	7.4.1
fortinet	fortios	7.2.5
fortinet	fortios	7.4.3
fortinet	fortios	7.2.0
fortinet	fortipam	1.3
fortinet	fortios	7.2.2
fortinet	fortios	7.2.6
fortinet	fortios	From 7.4.0 (inc) to 7.4.9 (inc)
fortinet	fortiproxy	From 7.6.0 (inc) to 7.6.4 (inc)
fortinet	fortisra	From 1.4.0 (inc) to 1.4.3 (exc)
fortinet	fortipam	From 1.0.0 (inc) to 1.4.3 (exc)
fortinet	fortisase	24.1.37

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability involves the insertion of sensitive information into log files in certain Fortinet products. Specifically, if REST API logging is enabled (which is not the default setting), a read-only administrator could access API tokens of other administrators by viewing the REST API logs. This occurs in FortiOS versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, all versions of 7.0, FortiProxy versions 7.4.0 through 7.4.3 and 7.2.0 through 7.2.11, all versions of FortiPAM 1.0 through 1.4, and all versions of FortiSRA 1.4.

Impact Analysis

This vulnerability can impact you by allowing a read-only administrator to retrieve sensitive API tokens of other administrators through log files if REST API logging is enabled. This could lead to unauthorized access or misuse of administrative privileges, potentially compromising the security and integrity of your systems.

Hi! I’m here to help you understand CVE-2024-47570. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70