Design/Logic Flaw

2024-02-1514:15:00

PRIOn knowledge base

www.prio-n.com

information exposure

vulnerability

fortinet fortimanager

fortianalyzer

cwe-200

http

https

nvd

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

14.2%

JSON

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiManager version 7.4.0 through 7.4.1 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.1 and before 7.2.5 and FortiAnalyzer-BigData before 7.2.5 allows an adom administrator to enumerate other adoms and device names via crafted HTTP or HTTPS requests.

CPENameOperatorVersion
fortianalyzerge6.2.0
fortianalyzerle6.2.12
fortianalyzereq7.4.0
fortianalyzerge7.2.0
fortianalyzerle7.2.3
fortianalyzerge6.4.0
fortianalyzerle6.4.14
fortianalyzerge7.0.0
fortianalyzerle7.0.11
fortianalyzereq7.4.1

Name	Operator	Version
fortianalyzer	ge	6.2.0
fortianalyzer	le	6.2.12
fortianalyzer	eq	7.4.0
fortianalyzer	ge	7.2.0
fortianalyzer	le	7.2.3
fortianalyzer	ge	6.4.0
fortianalyzer	le	6.4.14
fortianalyzer	ge	7.0.0
fortianalyzer	le	7.0.11
fortianalyzer	eq	7.4.1