#VU109039 Inclusion of Sensitive Information in Log Files in FortiPortal - CVE-2025-46777
Published: May 13, 2025
Vulnerability identifier: #VU109039
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-46777
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
FortiPortal
FortiPortal
Software vendor:
Fortinet, Inc
Fortinet, Inc
Description
The vulnerability allows a local privileged user to gain access to sensitive information.
The vulnerability exists due to information exposure through log files of sensitive information into system log. An authenticated attacker with at least read-only admin permissions can view encrypted secrets via the FortiPortal System Log.
Remediation
Install update from vendor's website.