FG-IR-24-311: Insertion of sensitive information into Event log
An insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiAnalyzer and FortiManager eventlog may allow any low privileged user with access to event log section to retrieve certificate private key and encrypted password logged as system log.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability FG-IR-24-311?
The vulnerability FG-IR-24-311 refers to the insertion of sensitive information into log files in FortiAnalyzer and FortiManager, allowing low privileged users to access certificate private keys and encrypted passwords.
What are the affected versions for vulnerability FG-IR-24-311?
The affected versions for vulnerability FG-IR-24-311 include FortiAnalyzer and FortiManager versions prior to 7.4.1, 7.2.4, 7.0.9, 6.4.13, and 6.2.12 depending on the specific version range.
How do I fix vulnerability FG-IR-24-311?
To fix vulnerability FG-IR-24-311, upgrade affected FortiAnalyzer and FortiManager systems to the recommended versions 7.4.1, 7.2.4, 7.0.9, 6.4.13, or 6.2.12.
What is the risk of not addressing vulnerability FG-IR-24-311?
The risk of not addressing vulnerability FG-IR-24-311 includes potential unauthorized access to sensitive information such as private keys and encrypted passwords by low privileged users.
Who is affected by the FG-IR-24-311 vulnerability?
Any organization using FortiAnalyzer and FortiManager versions specified in vulnerability FG-IR-24-311 that allows low privileged users to access the event log section is at risk.