CVE-2021-24008 Information disclosure in FortiDDoS
Remote unauthenticated attackers can obtain sensitive software version information by reading a JavaScript file on affected Fortinet devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24008?
CVE-2021-24008 is a medium-severity vulnerability in Fortinet FortiDDoS, published on 28 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file.
Weakness: CWE-200
Which versions are affected by CVE-2021-24008?
It affects 5 products.
Products include Fortinet Fortiddos, Fortinet Fortiddos-Cm, Fortinet Fortimail, Fortinet Fortirecorder, Fortinet Fortivoice.
How do I fix CVE-2021-24008?
No fix has been published for CVE-2021-24008 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24008 being exploited?
There is no known exploitation of CVE-2021-24008 in the wild and no public exploit code.
Other vulnerabilities in Fortinet FortiDDoS
Sources
Also known as GHSA-f254-h25h-9hpx.