CVE-2024-47570

At a glance

Severity: MEDIUM 6.3
EPSS: EPSS 0.40 % · percentile 35 (2026-10-27)
State: PUBLISHED
Published: 2025-12-09
Updated: 2026-02-26
Assigner: fortinet
NVD status: Analyzed

Description

An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.11; FortiPAM 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiSRA 1.4 all versions may allow a read-only administrator to retrieve API tokens of other administrators via observing REST API logs, if REST API logging is enabled (non-default configuration).

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 6.3	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C	fortinet
CVSS 3.1	MEDIUM 6.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	NVD · psirt@fortinet.com (Secondary)
CVSS 3.1	MEDIUM 6.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-532

European references

ENISA EUVD · EUVD-2024-55312
GCVE · GCVE-0-2024-47570

CERT-FR advisories

CERTFR-2025-AVI-1084 — Multiples vulnérabilités dans les produits Fortinet · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.12
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.4
cpe:2.3:a:fortinet:fortisase:24.1.37:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisra:*:*:*:*:*:*:*:* ≥ 1.4.0 ≤ 1.4.3
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.4 ≤ 7.0.17
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.8
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.4
cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:* ≥ 1.0.0 ≤ 1.4.3

Affected products

Product	Versions
Fortinet · FortiSASE	affected 24.1.10
Fortinet · FortiProxy	affected 7.4.0 ≤ 7.4.3 ; affected 7.2.0 ≤ 7.2.11
Fortinet · FortiSRA	affected 1.4.0 ≤ 1.4.3
Fortinet · FortiPAM	affected 1.4.0 ≤ 1.4.3 ; affected 1.3.0 ≤ 1.3.1 ; affected 1.2.0 ; affected 1.1.0 ≤ 1.1.2 ; affected 1.0.0 ≤ 1.0.3
Fortinet · FortiOS	affected 7.4.0 ≤ 7.4.3 ; affected 7.2.0 ≤ 7.2.7 ; affected 7.0.4 ≤ 7.0.18

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-268

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD