PT-2025-23069 · Fortinet · Fortiportal

Published 2025-05-13 · Updated 2025-06-04 · CVE-2025-46777

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiPortal versions 7.0.0 through 7.0.9 Fortinet FortiPortal versions 7.2.0 through 7.2.5 Fortinet FortiPortal version 7.4.0

Description The issue allows an authenticated attacker with at least read-only admin permissions to view encrypted secrets via the FortiPortal System Log due to the insertion of sensitive information into the log file.

Recommendations For Fortinet FortiPortal versions 7.0.0 through 7.0.9, update to a version that does not insert sensitive information into the log file. For Fortinet FortiPortal versions 7.2.0 through 7.2.5, update to a version that does not insert sensitive information into the log file. For Fortinet FortiPortal version 7.4.0, update to a version that does not insert sensitive information into the log file.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2025-09930

CVE-2025-46777

Affected Products

Fortiportal

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-46777 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-24-380 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09930 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46777 · Vendor Advisory
• https://twitter.com/CVEnew/status/1927641274598773096 · Twitter Post
• https://t.me/cvetracker/24805 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1927647636267360634 · Twitter Post
• https://t.me/cvenotify/124610 · Telegram Post