PSIRTInvocation of Process Using Visible Sensitive Information in FortiADC
Summary
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] in FortiADC Logs may allow an admin with read-only permission to get the external resources password via the logs of the product.
| Version | Affected | Solution |
|---|---|---|
| FortiADC 8.0 | Not affected | Not Applicable |
| FortiADC 7.6 | Not affected | Not Applicable |
| FortiADC 7.4 | 7.4.0 | Upgrade to 7.4.3 or above |
| FortiADC 7.2 | 7.2 all versions | Migrate to a fixed release |
| FortiADC 7.1 | 7.1 all versions | Migrate to a fixed release |
| FortiADC 7.0 | 7.0 all versions | Migrate to a fixed release |
| FortiADC 6.2 | 6.2 all versions | Migrate to a fixed release |
Workaround:
If used, disable the external resources, to prevent the leak of the password via the logs.
config system external-resource
edit <resource name>
set status disable
end