description: An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.15 and 6.4.0 through 6.4.15 allows attacker to information disclosure via HTTP requests.
problem types: Information disclosure
affected:
{
vendor: Fortinet
product: FortiOS
defaultStatus: unaffected
versions:
versionType: semver, version: 7.4.0, lessThanOrEqual: 7.4.1, status: affected
versionType: semver, version: 7.2.0, lessThanOrEqual: 7.2.5, status: affected
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.15, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.15, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X
]
solutions: Please upgrade to FortiOS version 7.4.2 or above
Please upgrade to FortiOS version 7.2.6 or above