An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1, 4.0.0 through 4.0.2, 3.3.0 through 3.3.3, 3.2.0 through 3.2.2,3.1.0 through 3.1.1 and 3.0.0 through 3.0.2 may allow a remote attacker to repeatedly enter incorrect credentials without causing a log entry, and with no limit on the number of failed authentication attempts.
When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fortideceptor | Fortinet | 3.0.0 (including) | 3.0.2 (including) |
| Fortideceptor | Fortinet | 3.2.0 (including) | 3.2.2 (including) |
| Fortideceptor | Fortinet | 3.3.0 (including) | 3.3.3 (including) |
| Fortideceptor | Fortinet | 4.0.0 (including) | 4.0.2 (including) |
| Fortideceptor | Fortinet | 3.1.0 (including) | 3.1.0 (including) |
| Fortideceptor | Fortinet | 3.1.1 (including) | 3.1.1 (including) |
| Fortideceptor | Fortinet | 4.1.0 (including) | 4.1.0 (including) |
| Fortideceptor | Fortinet | 4.1.1 (including) | 4.1.1 (including) |
| Fortideceptor | Fortinet | 4.2.0 (including) | 4.2.0 (including) |
| Fortisandbox | Fortinet | 3.1.0 (including) | 3.1.5 (including) |
| Fortisandbox | Fortinet | 4.0.0 (including) | 4.0.2 (including) |
| Fortisandbox | Fortinet | 3.2.0 (including) | 3.2.0 (including) |
| Fortisandbox | Fortinet | 3.2.1 (including) | 3.2.1 (including) |
| Fortisandbox | Fortinet | 3.2.2 (including) | 3.2.2 (including) |
| Fortisandbox | Fortinet | 3.2.3 (including) | 3.2.3 (including) |
When security-critical events are not logged properly, such as a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analysis after an attack succeeds. As organizations adopt cloud storage resources, these technologies often require configuration changes to enable detailed logging information, since detailed logging can incur additional costs. This could lead to telemetry gaps in critical audit logs. For example, in Azure, the default value for logging is disabled.