PT-2025-50108 · Fortinet · Fortisra+3

Published 2025-12-09 · Updated 2025-12-10 · CVE-2024-47570

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.0 through 7.4.3 FortiProxy versions 7.2.0 through 7.4.3 FortiPAM versions 1.0 through 1.4 FortiSRA version 1.4

Description A flaw exists where sensitive information can be written to log files. Specifically, a read-only administrator may be able to obtain API tokens belonging to other administrators by examining REST API logs, provided REST API logging is enabled. The REST API logs are involved in this issue. The vulnerable parameter is the API token.

Recommendations FortiOS versions prior to 7.4.4 FortiProxy versions prior to 7.2.12 FortiPAM versions prior to 1.5 FortiSRA versions prior to 1.5

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2026-00835

CVE-2024-47570

Affected Products

Fortios

Fortipam

Fortiproxy

Fortisra

References · 5

• https://bdu.fstec.ru/vul/2026-00835 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47570 · Vendor Advisory
• https://fortiguard.fortinet.com/psirt/FG-IR-24-268 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47570 · Security Note
• https://twitter.com/CVEnew/status/1998781391899689436 · Twitter Post