CVE-2024-40585: Insertion of sensitive information into Event log
An insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiAnalyzer and FortiManager eventlog may allow any low privileged user with access to event log section to retrieve certificate private key and encrypted password logged as system log.
Other sources
An insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiManager version 7.4.0, version 7.2.3 and below, version 7.0.8 and below, version 6.4.12 and below, version 6.2.11 and below and FortiAnalyzer version 7.4.0, version 7.2.3 and below, version 7.0.8 and below, version 6.4.12 and below, version 6.2.11 and below eventlog may allow any low privileged user with access to event log section to retrieve certificate private key and encrypted password logged as system log.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40585?
CVE-2024-40585 is classified as a high severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2024-40585?
To fix CVE-2024-40585, update FortiAnalyzer and FortiManager to the recommended versions or later as specified in the advisory.
Which Fortinet products are affected by CVE-2024-40585?
CVE-2024-40585 affects various versions of FortiAnalyzer and FortiManager, specifically those below the specified remediation versions.
What kind of information can be retrieved due to CVE-2024-40585?
CVE-2024-40585 allows low privileged users to retrieve sensitive information such as certificate private keys and encrypted passwords from system logs.
Who is vulnerable to CVE-2024-40585?
Any organization using affected versions of FortiAnalyzer or FortiManager with low privileged access to the event log section is vulnerable to CVE-2024-40585.