FG-IR-24-257: Information Disclosure on SSLVPN endpoint
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] in FortiOS SSL-VPN web-mode may allow an authenticated user to access full SSL-VPN settings via crafted URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If SSL‑VPN web‑mode is not required, disable FortiOS SSL‑VPN web‑mode to prevent access to SSL‑VPN settings via crafted URLs until an official fix is available.
FortiOS SSL-VPN web-mode web-mode = disabled - Compensating control
Restrict access to the SSLVPN endpoint and its management interfaces (e.g., via firewall rules, network ACLs, or segmentation) to trusted IP ranges and administrators only to reduce exposure until a patch is available.
Event History
Frequently Asked Questions
What is the severity of FG-IR-24-257?
The FG-IR-24-257 vulnerability is classified as a high severity issue due to its potential to expose sensitive information to unauthorized users.
How do I fix FG-IR-24-257?
To address FG-IR-24-257, upgrade to FortiOS versions 7.6.1 or 7.4.8, as these versions contain the necessary patches.
What are the impacts of FG-IR-24-257?
The impacts of FG-IR-24-257 include unauthorized access to full SSL-VPN settings by an authenticated user.
Which versions of FortiOS are affected by FG-IR-24-257?
FG-IR-24-257 affects FortiOS versions 6.4, 7.0, 7.2, and those between 7.4.0 and 7.4.7.
Who is affected by FG-IR-24-257?
Organizations using vulnerable versions of FortiOS for SSL-VPN may be affected by FG-IR-24-257, especially if proper security practices are not followed.