Search criteria

5 vulnerabilities found for FortiDDoS-CM by Fortinet

CERTFR-2025-AVI-0259

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Fortinet FortiDDoS FortiDDoS versions antérieures à 5.4.3
Fortinet FortiDDoS-CM FortiDDOS-CM versions antérieures à 5.4.1
Fortinet FortiMail FortiMail versions 6.4.x antérieures à 6.4.2
Fortinet FortiVoice FortiVoice versions antérieures à 6.0.7
Fortinet FortiMail FortiMail versions 6.2.x antérieures à 6.2.5
Fortinet FortiRecorder FortiRecorder versions antérieures à 6.0.4
Fortinet FortiMail FortiMail versions antérieures à 6.0.10
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiDDoS versions ant\u00e9rieures \u00e0 5.4.3",
      "product": {
        "name": "FortiDDoS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiDDOS-CM versions ant\u00e9rieures \u00e0 5.4.1",
      "product": {
        "name": "FortiDDoS-CM",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 6.4.x ant\u00e9rieures \u00e0 6.4.2",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiVoice versions ant\u00e9rieures \u00e0 6.0.7",
      "product": {
        "name": "FortiVoice",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 6.2.x ant\u00e9rieures \u00e0 6.2.5",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiRecorder versions ant\u00e9rieures \u00e0 6.0.4",
      "product": {
        "name": "FortiRecorder",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions ant\u00e9rieures \u00e0 6.0.10",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2021-24008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-24008"
    },
    {
      "name": "CVE-2020-15933",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15933"
    }
  ],
  "links": [],
  "reference": "CERTFR-2025-AVI-0259",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-04-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Fortinet. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
  "vendor_advisories": [
    {
      "published_at": "2025-03-28",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-105",
      "url": "https://www.fortiguard.com/psirt/FG-IR-20-105"
    }
  ]
}

FKIE_CVE-2021-24008

Vulnerability from fkie_nvd - Published: 2025-03-28 11:15 - Updated: 2025-07-24 19:57
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file.
References
psirt@fortinet.comhttps://fortiguard.fortinet.com/psirt/FG-IR-20-105Vendor Advisory
Impacted products
Vendor Product Version
fortinet fortimail *
fortinet fortimail *
fortinet fortimail *
fortinet fortiddos *
fortinet fortivoice *
fortinet fortirecorder *
fortinet fortiddos-cm 4.7.0
fortinet fortiddos-cm 5.0.0
fortinet fortiddos-cm 5.1.0
fortinet fortiddos-cm 5.2.0
fortinet fortiddos-cm 5.3.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F99B304-8B86-424C-8548-7DD5A0A901E0",
              "versionEndExcluding": "6.0.10",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6896BC5-4B25-45DC-B3C5-8BB80E7C0694",
              "versionEndExcluding": "6.2.5",
              "versionStartIncluding": "6.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "747A8704-F9ED-4710-9B89-C11E49EA7484",
              "versionEndExcluding": "6.4.2",
              "versionStartIncluding": "6.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiddos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0DAD000-EF92-4833-9360-4E93D3597360",
              "versionEndExcluding": "5.4.3",
              "versionStartIncluding": "4.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B6B81F4B-C56A-433B-B9AA-35E35031D711",
              "versionEndExcluding": "6.0.7",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C0899107-6CAD-40E6-827D-15A73CDB3953",
              "versionEndExcluding": "6.0.4",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiddos-cm:4.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9137E599-E5EE-4A4E-ADCE-02842FC5C2FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiddos-cm:5.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "ABBCB00D-8C50-414E-8918-258EF062515D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiddos-cm:5.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "82CCAFC5-D480-430A-902C-8B92D20AC09D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiddos-cm:5.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9301AAD-CDDE-4480-97A9-0C1EFF2EB31F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiddos-cm:5.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "01A0FC0C-A37F-450E-82F3-9B0C4C4752B6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file."
    },
    {
      "lang": "es",
      "value": "Una exposici\u00f3n de informaci\u00f3n sensible del sistema a una vulnerabilidad de esfera de control no autorizada [CWE-497] en FortiDDoS versi\u00f3n 5.4.0, versi\u00f3n 5.3.2 y anteriores, versi\u00f3n 5.2.0, versi\u00f3n 5.1.0, versi\u00f3n 5.0.0, versi\u00f3n 4.7.0, versi\u00f3n 4.6.0, versi\u00f3n 4.5.0, versi\u00f3n 4.4.2 y anteriores, FortiDDoS-CM versi\u00f3n 5.3.0, versi\u00f3n 5.2.0, versi\u00f3n 5.1.0, versi\u00f3n 5.0.0, versi\u00f3n 4.7.0, FortiVoice versi\u00f3n 6.0.6 y anteriores, FortiRecorder versi\u00f3n 6.0.3 y anteriores y FortiMail versi\u00f3n 6.4.1 y anteriores, versi\u00f3n 6.2.4 y anteriores, versi\u00f3n 6.0.9 y anteriores puede permitir que un atacante remoto no autenticado obtenga informaci\u00f3n potencialmente sensible de la versi\u00f3n del software leyendo un archivo JavaScript."
    }
  ],
  "id": "CVE-2021-24008",
  "lastModified": "2025-07-24T19:57:26.330",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-03-28T11:15:36.620",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-20-105"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "psirt@fortinet.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2021-24008 (GCVE-0-2021-24008)

Vulnerability from cvelistv5 – Published: 2025-03-28 10:13 – Updated: 2025-03-28 13:39
VLAI?
Summary
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file.
Severity ?
5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X
CWE
Assigner
References
Impacted products
Vendor Product Version
Fortinet FortiDDoS Affected: 5.4.0
Affected: 5.3.0 , ≤ 5.3.2 (semver)
Affected: 5.2.0
Affected: 5.1.0
Affected: 5.0.0
Affected: 4.7.0
Affected: 4.6.0
Affected: 4.5.0
Affected: 4.4.0 , ≤ 4.4.2 (semver)
    cpe:2.3:o:fortinet:fortiddos:5.4.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:5.3.2:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:5.3.1:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:5.3.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:5.2.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:5.1.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:5.0.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:4.7.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:4.6.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:4.5.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:4.4.2:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:4.4.1:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:4.4.0:*:*:*:*:*:*:*
 Create a notification for this product.
    Fortinet FortiNDR Affected: 1.5.0 , ≤ 1.5.3 (semver)
Affected: 1.4.0
Affected: 1.3.0 , ≤ 1.3.1 (semver)
Affected: 1.2.0
Affected: 1.1.0
Create a notification for this product.
    Fortinet FortiDDoS-CM Affected: 5.3.0
Affected: 5.2.0
Affected: 5.1.0
Affected: 5.0.0
Affected: 4.7.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-24008",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-28T13:38:44.887350Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-28T13:39:11.758Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortiddos:5.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:5.3.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:5.3.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:5.3.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:5.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:5.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:5.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:4.7.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:4.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:4.5.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:4.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:4.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:4.4.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiDDoS",
          "vendor": "Fortinet",
          "versions": [
            {
              "status": "affected",
              "version": "5.4.0"
            },
            {
              "lessThanOrEqual": "5.3.2",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.2.0"
            },
            {
              "status": "affected",
              "version": "5.1.0"
            },
            {
              "status": "affected",
              "version": "5.0.0"
            },
            {
              "status": "affected",
              "version": "4.7.0"
            },
            {
              "status": "affected",
              "version": "4.6.0"
            },
            {
              "status": "affected",
              "version": "4.5.0"
            },
            {
              "lessThanOrEqual": "4.4.2",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [],
          "defaultStatus": "unaffected",
          "product": "FortiNDR",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "1.5.3",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "lessThanOrEqual": "1.3.1",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.2.0"
            },
            {
              "status": "affected",
              "version": "1.1.0"
            }
          ]
        },
        {
          "cpes": [],
          "defaultStatus": "unaffected",
          "product": "FortiDDoS-CM",
          "vendor": "Fortinet",
          "versions": [
            {
              "status": "affected",
              "version": "5.3.0"
            },
            {
              "status": "affected",
              "version": "5.2.0"
            },
            {
              "status": "affected",
              "version": "5.1.0"
            },
            {
              "status": "affected",
              "version": "5.0.0"
            },
            {
              "status": "affected",
              "version": "4.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Information disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-28T10:13:32.120Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-20-105",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-20-105"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Please upgrade to FortiMail versions 6.0.10 or above.\n\r\nPlease upgrade to FortiMail versions 6.2.5 or above.\n\r\nPlease upgrade to FortiMail versions 6.4.2 or above."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2021-24008",
    "datePublished": "2025-03-28T10:13:32.120Z",
    "dateReserved": "2021-01-13T21:23:47.335Z",
    "dateUpdated": "2025-03-28T13:39:11.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-24008 (GCVE-0-2021-24008)

Vulnerability from nvd – Published: 2025-03-28 10:13 – Updated: 2025-03-28 13:39
VLAI?
Summary
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file.
Severity ?
5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X
CWE
Assigner
References
Impacted products
Vendor Product Version
Fortinet FortiDDoS Affected: 5.4.0
Affected: 5.3.0 , ≤ 5.3.2 (semver)
Affected: 5.2.0
Affected: 5.1.0
Affected: 5.0.0
Affected: 4.7.0
Affected: 4.6.0
Affected: 4.5.0
Affected: 4.4.0 , ≤ 4.4.2 (semver)
    cpe:2.3:o:fortinet:fortiddos:5.4.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:5.3.2:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:5.3.1:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:5.3.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:5.2.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:5.1.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:5.0.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:4.7.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:4.6.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:4.5.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:4.4.2:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:4.4.1:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortiddos:4.4.0:*:*:*:*:*:*:*
 Create a notification for this product.
    Fortinet FortiNDR Affected: 1.5.0 , ≤ 1.5.3 (semver)
Affected: 1.4.0
Affected: 1.3.0 , ≤ 1.3.1 (semver)
Affected: 1.2.0
Affected: 1.1.0
Create a notification for this product.
    Fortinet FortiDDoS-CM Affected: 5.3.0
Affected: 5.2.0
Affected: 5.1.0
Affected: 5.0.0
Affected: 4.7.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-24008",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-28T13:38:44.887350Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-28T13:39:11.758Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortiddos:5.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:5.3.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:5.3.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:5.3.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:5.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:5.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:5.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:4.7.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:4.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:4.5.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:4.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:4.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortiddos:4.4.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiDDoS",
          "vendor": "Fortinet",
          "versions": [
            {
              "status": "affected",
              "version": "5.4.0"
            },
            {
              "lessThanOrEqual": "5.3.2",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.2.0"
            },
            {
              "status": "affected",
              "version": "5.1.0"
            },
            {
              "status": "affected",
              "version": "5.0.0"
            },
            {
              "status": "affected",
              "version": "4.7.0"
            },
            {
              "status": "affected",
              "version": "4.6.0"
            },
            {
              "status": "affected",
              "version": "4.5.0"
            },
            {
              "lessThanOrEqual": "4.4.2",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [],
          "defaultStatus": "unaffected",
          "product": "FortiNDR",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "1.5.3",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "lessThanOrEqual": "1.3.1",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.2.0"
            },
            {
              "status": "affected",
              "version": "1.1.0"
            }
          ]
        },
        {
          "cpes": [],
          "defaultStatus": "unaffected",
          "product": "FortiDDoS-CM",
          "vendor": "Fortinet",
          "versions": [
            {
              "status": "affected",
              "version": "5.3.0"
            },
            {
              "status": "affected",
              "version": "5.2.0"
            },
            {
              "status": "affected",
              "version": "5.1.0"
            },
            {
              "status": "affected",
              "version": "5.0.0"
            },
            {
              "status": "affected",
              "version": "4.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Information disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-28T10:13:32.120Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-20-105",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-20-105"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Please upgrade to FortiMail versions 6.0.10 or above.\n\r\nPlease upgrade to FortiMail versions 6.2.5 or above.\n\r\nPlease upgrade to FortiMail versions 6.4.2 or above."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2021-24008",
    "datePublished": "2025-03-28T10:13:32.120Z",
    "dateReserved": "2021-01-13T21:23:47.335Z",
    "dateUpdated": "2025-03-28T13:39:11.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}