5.0
Medium
CVE-2021-24008 An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS…
Description
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiDDoS | 5.4.0 | No fix stated |
| FortiDDoS 5.3 | 5.3.0 → 5.3.2 | No fix stated |
| FortiDDoS | 5.2.0 | No fix stated |
| FortiDDoS | 5.1.0 | No fix stated |
| FortiDDoS | 5.0.0 | No fix stated |
| FortiDDoS | 4.7.0 | No fix stated |
| FortiDDoS | 4.6.0 | No fix stated |
| FortiDDoS | 4.5.0 | No fix stated |
| FortiDDoS 4.4 | 4.4.0 → 4.4.2 | No fix stated |
Show the 10 other branches Hide the 10 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiNDR 1.5 | 1.5.0 → 1.5.3 | No fix stated |
| FortiNDR | 1.4.0 | No fix stated |
| FortiNDR 1.3 | 1.3.0 → 1.3.1 | No fix stated |
| FortiNDR | 1.2.0 | No fix stated |
| FortiNDR | 1.1.0 | No fix stated |
| FortiDDoS-CM | 5.3.0 | No fix stated |
| FortiDDoS-CM | 5.2.0 | No fix stated |
| FortiDDoS-CM | 5.1.0 | No fix stated |
| FortiDDoS-CM | 5.0.0 | No fix stated |
| FortiDDoS-CM | 4.7.0 | No fix stated |
References
- fortiguard.fortinet.com fortiguard.fortinet.com
Timeline
- Published
- Last modified
Other CVEs of FortiDDoS
The 6 CVEs of FortiDDoS →
CVE-2022-23439
A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison…
4.1
Medium
CVE-2022-27486
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS…
5.9
Medium
CVE-2022-40679
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all…
7.1
High
CVE-2021-36193
Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an…
6.3
Medium