description: A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version 6.0.0 through 6.0.9, 5.3.0 through 5.3.8, 5.2.x, 5.1.0, 5.0.x, 4.2.x, 4.1.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.x, 6.0.x allows an attacker which has obtained access to a restricted administrative account to obtain sensitive information via `diagnose debug` commands.
problem types: Information disclosure
affected:
{
vendor: Fortinet
product: FortiManager
defaultStatus: unaffected
versions:
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.4, status: affected
versionType: semver, version: 5.6.0, lessThanOrEqual: 5.6.11, status: affected
}
{
vendor: Fortinet
product: FortiAnalyzer
defaultStatus: unaffected
versions:
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.4, status: affected
versionType: semver, version: 5.6.0, lessThanOrEqual: 5.6.11, status: affected
}
{
vendor: Fortinet
product: FortiPortal
defaultStatus: unaffected
versions:
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.9, status: affected
versionType: semver, version: 5.3.0, lessThanOrEqual: 5.3.8, status: affected
versionType: semver, version: 5.2.0, lessThanOrEqual: 5.2.6, status: affected
versionType: semver, version: 5.1.0, lessThanOrEqual: 5.1.2, status: affected
versionType: semver, version: 5.0.0, lessThanOrEqual: 5.0.3, status: affected
versionType: semver, version: 4.2.0, lessThanOrEqual: 4.2.2, status: affected
versionType: semver, version: 4.1.0, lessThanOrEqual: 4.1.2, status: affected
}
{
vendor: Fortinet
product: FortiSwitch
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.4, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.10, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.7, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.7, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C
]
solutions: Upgrade to FortiManager version 6.0.5 and above,
Upgrade to FortiManager version 6.2.0 and above.
Upgrade to FortiAnalyzer version 6.0.5 and above,
Upgrade to FortiAnalyzer version 6.2.0 and above.
Upgrade to FortiPortal version 6.0.10 and above.
Upgrade to FortiSwitch version 6.4.11 and above,
Upgrade to FortiSwitch version 7.0.5 and above.