Sensitive Information Exposure in FortiOS from Fortinet

CVE-2020-29010

Summary

An exposure of sensitive information to unauthorized actors occurs in FortiOS versions 6.2.4 and earlier, and 6.0.10 and earlier. This vulnerability allows remote authenticated users to read SSL VPN event log entries of users across different VDOMs by executing the 'get vpn ssl monitor' command via the command line interface. The data exposed includes sensitive information such as usernames, user groups, and IP addresses, which could be leveraged for further attacks or unauthorized access.

References