Fortinet Products Sensitive Information Disclosure Vulnerability

A vulnerability allowing the insertion of sensitive information into sent data has been identified in multiple Fortinet products, including FortiManager Cloud, FortiVoice, FortiMail, FortiOS, FortiWeb, FortiRecorder, FortiNDR, FortiPAM, FortiTester, and FortiProxy. This vulnerability affects various versions across these products, with the exception of certain FortiManager, FortiNDR, FortiPAM, FortiTester, FortiVoice, and FortiWeb versions. The issue allows a remote authenticated attacker to disclose sensitive information by sending specially crafted packets, potentially leading to the unauthorized reading of small, non-arbitrary parts of memory.

Impact

Exploitation of this vulnerability could result in unauthorized disclosure of sensitive information, allowing attackers to read small and non-arbitrary parts of memory.

Remediation

Users can upgrade to the latest versions or migrate to fixed releases, depending on the specific Fortinet product. Detailed upgrade instructions are available on the Fortinet documentation site.