Fortinet FortiOS Sensitive Information Exposure Vulnerability in SSL VPN Events Log

A vulnerability allowing the exposure of sensitive information to unauthorized actors has been identified in Fortinet FortiOS versions 6.2.4 and prior, as well as 6.0.10 and prior. This vulnerability may enable remote authenticated actors to access the SSL VPN events log entries of users in different VDOMs by executing 'get vpn ssl monitor' from the CLI. The exposed data includes usernames, user groups, and IP addresses.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive user information, including usernames, user groups, and IP addresses, from the SSL VPN events log of other VDOMs.