Vulnerability · Published Mar 14, 2025 · Assigned by fortinet
CVE-2024-40585
Medium 5.9
In plain English
A medium-severity sensitive data in logs in FortiAnalyzer from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
An insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiManager version 7.4.0, version 7.2.3 and below, version 7.0.8 and below, version 6.4.12 and below, version 6.2.11 and below and FortiAnalyzer version 7.4.0, version 7.2.3 and below, version 7.0.8 and below, version 6.4.12 and below, version 6.2.11 and below eventlog may allow any low privileged user with access to event log section to retrieve certificate private key and encrypted password logged as system log.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiAnalyzer | 7.4.07.2.0 – through 7.2.37.0.0 – through 7.0.86.4.0 – through 6.4.126.2.0 – through 6.2.11 |
| Fortinet | FortiManager | 7.4.07.2.0 – through 7.2.37.0.0 – through 7.0.86.4.0 – through 6.4.126.2.0 – through 6.2.11 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:R