Fortinet FortiOS and FortiProxy Improper Authorization Vulnerability Allowing Access to Static Files in Other VDOMs

A vulnerability allowing improper authorization has been identified in Fortinet FortiOS versions 7.4.0 through 7.4.1 and prior to 7.2.8, as well as in Fortinet FortiProxy versions prior to 7.4.8. This vulnerability allows an authenticated attacker to access static files from other VDOMs by sending crafted HTTP or HTTPS requests.

Impact

Exploitation of this vulnerability could lead to unauthorized access to static files in other VDOMs, potentially allowing for the disclosure of sensitive information.

Remediation

Users of Fortinet FortiOS should upgrade to version 7.4.2 or 7.2.9, depending on their current version. Fortinet FortiProxy users should upgrade to version 7.4.9 or migrate to a fixed release, depending on their current version. A virtual patch is also available for Fortinet FortiOS users.