CVE Vulnerabilities

CVE-2024-47570

Insertion of Sensitive Information into Log File

Published: Dec 09, 2025 | Modified: Dec 10, 2025
CVSS 3.x
6.6
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.11; FortiPAM 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiSRA 1.4 all versions may allow a read-only administrator to retrieve API tokens of other administrators via observing REST API logs, if REST API logging is enabled (non-default configuration).

Weakness

The product writes sensitive information to a log file.

Affected Software

Name Vendor Start Version End Version
Fortiproxy Fortinet 7.2.0 (including) 7.2.12 (excluding)
Fortiproxy Fortinet 7.4.0 (including) 7.4.4 (excluding)
Fortisase Fortinet 24.1.37 (including) 24.1.37 (including)
Fortisra Fortinet 1.4.0 (including) 1.4.3 (including)
Fortios Fortinet 7.0.4 (including) 7.0.17 (including)
Fortios Fortinet 7.2.0 (including) 7.2.8 (excluding)
Fortios Fortinet 7.4.0 (including) 7.4.4 (excluding)
Fortipam Fortinet 1.0.0 (including) 1.4.3 (including)

Potential Mitigations

References