FortiGate & FortiADC - Read-only admins can obtain the LDAP credentials configured in the FortiGate and FortiADC using the LDAP test connectivity feature


FortiGate's and FortiADC's  read-only admins are able to point an LDAP server connectivity test request to a rogue LDAP server instead of the configured one, in order to obtain the LDAP server login credentials configured in the FortiGate.

Affected Products

FortiOS 6.0.2 and before FortiADC 6.1.0 and before FortiADC 6.0.1 and before FortiADC 5.4.4 and before


Upgrade to FortiOS 6.0.3 or upcoming 6.2.0 Please upgrade to FortiADC 6.1.1 or above. Please upgrade to FortiADC 6.0.2 or above. Please upgrade to FortiADC 5.4.5 or above.


Fortinet is pleased to thank Julio Engels Ureña Martinez for reporting this vulnerability under responsible disclosure.