Inclusion of Sensitive Information in Log Files in FortiPortal - CVE-2025-46777
Published: May 13, 2025
Vulnerability identifier: #VU109039
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-46777
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to gain access to sensitive information.
The vulnerability exists due to information exposure through log files of sensitive information into system log. An authenticated attacker with at least read-only admin permissions can view encrypted secrets via the FortiPortal System Log.
Affected software
FortiPortal
How to mitigate CVE-2025-46777
Install update from vendor's website.
FortiPortal - addressed in versions 7.0.10, 7.2.6, 7.4.2