PT-2024-5557 · Fortinet · Fortiaiops

Published 2024-07-09 · Updated 2026-01-09 · CVE-2024-27784

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiAIOps version 2.0.0

Description The issue concerns the exposure of sensitive information to unauthorized actors. An authenticated, remote attacker may retrieve sensitive information from the API endpoint or log files. This is related to a lack of protection for service data.

Recommendations For FortiAIOps version 2.0.0, consider restricting access to the API endpoint and log files to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of authenticated users to reduce the potential impact of sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Insertion into Log File

Weakness Enumeration

CWE-200

CWE-532

Related Identifiers

BDU:2024-06236

CVE-2024-27784

Affected Products

Fortiaiops

References · 11

• https://fortiguard.fortinet.com/psirt/FG-IR-24-072 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27784 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06236 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-27784 · Security Note
• https://twitter.com/CVEnew/status/1810700130867089881 · Twitter Post
• https://twitter.com/CCBalert/status/1811063422882107695 · Twitter Post
• https://twitter.com/CveFindCom/status/1811098447698604257 · Twitter Post
• https://t.me/cvedetector/372 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1811237436107997340 · Twitter Post
• https://t.me/cvenotify/93835 · Telegram Post
• https://t.me/cveNotify/148246 · Telegram Post