PT-2024-24119 · Fortinet · Fortisoar

Published 2024-06-03 · Updated 2025-01-21 · CVE-2024-31493

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiSOAR versions 7.0.3 and below FortiSOAR versions 7.2.2 and below FortiSOAR version 7.3.0

Description The issue allows an authenticated low privileged user to read Connector passwords in plain-text via HTTP responses due to an improper removal of sensitive information before storage or transfer.

Recommendations For FortiSOAR versions 7.0.3 and below, update to a version that fixes the improper removal of sensitive information before storage or transfer. For FortiSOAR versions 7.2.2 and below, update to a version that fixes the improper removal of sensitive information before storage or transfer. For FortiSOAR version 7.3.0, update to a version that fixes the improper removal of sensitive information before storage or transfer.

Fix

Weakness Enumeration

CWE-212

Related Identifiers

CVE-2024-31493

Affected Products

Fortisoar

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-31493 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31493 · Vendor Advisory
• https://fortiguard.fortinet.com/psirt/FG-IR-24-052 · Vendor Advisory
• https://t.me/cvenotify/108151 · Telegram Post
• https://t.me/cvenotify/81716 · Telegram Post