Inclusion of Sensitive Information in Log Files in FortiPortal - CVE-2025-46777
Published: May 13, 2025
Vulnerability identifier: #VU109039
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-46777
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Fortinet, Inc
Affected software:
FortiPortal
FortiPortal
Detailed vulnerability description
The vulnerability allows a local privileged user to gain access to sensitive information.
The vulnerability exists due to information exposure through log files of sensitive information into system log. An authenticated attacker with at least read-only admin permissions can view encrypted secrets via the FortiPortal System Log.
How to mitigate CVE-2025-46777
Install update from vendor's website.