CVE-2021-24024 Information disclosure in Fortinet FortiADCManager, FortiADC

Medium 4.3 Published 12 Apr 2021 Updated 25 Oct 2024

Remote authenticated attackers can read other users' passwords from log files due to clear text storage in FortiADCManager and FortiADC.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-24024?

CVE-2021-24024 is a medium-severity vulnerability in Fortinet FortiADCManager, FortiADC, published on 12 Apr 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote authenticated attacker to read other local users' password in log files.

Weakness: CWE-532

Which versions are affected by CVE-2021-24024?

It affects 2 products.

Products include Fortinet Fortiadc, Fortinet Fortiadc Manager.

How do I fix CVE-2021-24024?

No fix has been published for CVE-2021-24024 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-24024 being exploited?

There is no known exploitation of CVE-2021-24024 in the wild and no public exploit code.

Sources

Also known as GHSA-hf5v-r8xg-7r35.