description: A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and 5.4.x before 5.4.2 GA may have access to read-write administrators password hashes (not including super-admins) stored on the appliance via the webui REST API, and may therefore be able to crack them.
problem types: Information leak
affected:
{
product: FortiOS
vendor: Fortinet
versions:
status: affected, version: 5.2.0 - 5.2.9, 5.4.1
}