Sensitive Information Exposure in FortiManager and FortiAnalyzer

CVE-2024-40585

What is CVE-2024-40585?

A vulnerability exists in FortiManager and FortiAnalyzer, where sensitive information, including private keys and encrypted passwords, may be insecurely logged in the system logs. This flaw allows unauthorized low-privileged users with access to the event log section to retrieve this sensitive data, posing significant risks to system integrity and security. It's critical for users to review their configurations and monitor access to mitigate potential risks.

References