CVE-2020-29010 - An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay allow remote authenticated actors to read the SSL VPN events log entries of users in other VDOMs by executing "get vpn ssl monitor" from the CLI

Back Back to CVE browser

MEDIUM

An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay allow remote authenticated actors to read the SSL VPN events log entries of users in other VDOMs by executing "get vpn ssl monitor" from the CLI

Published Mar 17, 2025

5.0

MEDIUM

CVSS 3.1

EPSS 0.57%

Description

An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay allow remote authenticated actors to read the SSL VPN events log entries of users in other VDOMs by executing "get vpn ssl monitor" from the CLI. The sensitive data includes usernames, user groups, and IP address.

Affected products

Vendor Fortinet Product FortiOS Default
unaffected
- Version
  6.0.0
  Status
  affected
  Constraints
  <=6.0.10
- Version
  6.2.1
  Status
  affected
  Constraints
  <=6.2.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fortinet

FortiOS

unaffected

Version	Status	Constraints
6.0.0	affected	<=6.0.10
6.2.1	affected	<=6.2.4

Remediation

Vendor solution

Please upgrade to FortiGate version 6.0.11 or above. Please upgrade to FortiGate version 6.2.5 or above. Please upgrade to FortiGate version 6.4.2 or above.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information