Fortinet FortiPAM Cleartext Storage of Credentials Vulnerability

A vulnerability allowing cleartext storage of sensitive information in memory has been identified in Fortinet FortiPAM versions 1.0 through 1.6.0, as well as all versions of 1.1, 1.2, 1.3, 1.4, and 1.5. This vulnerability may enable an authenticated attacker with read-write admin privileges to the CLI to access the credentials of other administrators through diagnose commands.

Impact

Exploitation of this vulnerability could lead to unauthorized access to administrative credentials, allowing for potential misuse of administrative privileges.

Remediation

Users of Fortinet FortiPAM 1.6.0 should upgrade to 1.6.1 or above. Users of Fortinet FortiPAM versions 1.0, 1.1, 1.2, 1.3, 1.4, and 1.5 should migrate to a fixed release.