Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiPortal Key Management Vulnerability Allowing Private Key Retrieval

A vulnerability allowing the retrieval of a certificate's private key through the admin shell has been identified in multiple Fortinet products, including FortiAnalyzer, FortiManager, FortiOS, and FortiPortal. This vulnerability affects several different versions and stems from key management errors that may allow an authenticated admin to access private keys.

Impact

Exploitation of this vulnerability could lead to improper access control, allowing unauthorized retrieval of private keys by authenticated administrators.

Remediation

Users can upgrade FortiAnalyzer to version 7.4.3 or above, 7.2.6 or above, and FortiManager to version 7.4.3 or above, 7.2.6 or above. FortiOS users should upgrade to version 7.6.1 or above, 7.4.5 or above, 7.2.8 or above, and 7.0.15 or above. FortiPortal users should migrate to a fixed release.