CVE-2024-47570
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-10
Assigner: Fortinet, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fortinet | fortiproxy | 7.2.1 |
| fortinet | fortios | 7.2.1 |
| fortinet | fortiproxy | 7.2.3 |
| fortinet | fortiproxy | 7.2.7 |
| fortinet | fortios | 7.2.3 |
| fortinet | fortios | 7.2.7 |
| fortinet | fortios | 7.4.2 |
| fortinet | fortiproxy | 7.4.1 |
| fortinet | fortipam | 1.1 |
| fortinet | fortios | 7.2.4 |
| fortinet | fortiproxy | 7.2.2 |
| fortinet | fortios | 7.4.0 |
| fortinet | fortipam | 1.4 |
| fortinet | fortiproxy | 7.2.0 |
| fortinet | fortiproxy | 7.4.2 |
| fortinet | fortiproxy | 7.4.0 |
| fortinet | fortiproxy | 7.2.4 |
| fortinet | fortipam | 1.0 |
| fortinet | fortisra | 1.4 |
| fortinet | fortiproxy | 7.4.3 |
| fortinet | fortipam | 1.2 |
| fortinet | fortiproxy | 7.2.6 |
| fortinet | fortiproxy | 7.2.5 |
| fortinet | fortios | 7.4.1 |
| fortinet | fortios | 7.2.5 |
| fortinet | fortios | 7.4.3 |
| fortinet | fortios | 7.2.0 |
| fortinet | fortipam | 1.3 |
| fortinet | fortios | 7.2.2 |
| fortinet | fortios | 7.2.6 |
| fortinet | fortios | From 7.4.0 (inc) to 7.4.9 (inc) |
| fortinet | fortiproxy | From 7.6.0 (inc) to 7.6.4 (inc) |
| fortinet | fortisra | From 1.4.0 (inc) to 1.4.3 (exc) |
| fortinet | fortipam | From 1.0.0 (inc) to 1.4.3 (exc) |
| fortinet | fortisase | 24.1.37 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the insertion of sensitive information into log files in certain Fortinet products. Specifically, if REST API logging is enabled (which is not the default setting), a read-only administrator could access API tokens of other administrators by viewing the REST API logs. This occurs in FortiOS versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, all versions of 7.0, FortiProxy versions 7.4.0 through 7.4.3 and 7.2.0 through 7.2.11, all versions of FortiPAM 1.0 through 1.4, and all versions of FortiSRA 1.4.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing a read-only administrator to retrieve sensitive API tokens of other administrators through log files if REST API logging is enabled. This could lead to unauthorized access or misuse of administrative privileges, potentially compromising the security and integrity of your systems.