CVE-2021-24008, CoreCVE

Back Back to CVE browser

MEDIUM

An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file

Published Mar 28, 2025

5.3

MEDIUM

CVSS 3.1

EPSS 0.50%

Description

An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file.

Affected products

Vendor Fortinet Product FortiDDoS Default
unaffected
- Version
  4.4.0
  Status
  affected
  Constraints
  <=4.4.2
- Version
  4.5.0
  Status
  affected
  Constraints
  -
- Version
  4.6.0
  Status
  affected
  Constraints
  -
- Version
  4.7.0
  Status
  affected
  Constraints
  -
- Version
  5.0.0
  Status
  affected
  Constraints
  -
- Version
  5.1.0
  Status
  affected
  Constraints
  -
- Version
  5.2.0
  Status
  affected
  Constraints
  -
- Version
  5.3.0
  Status
  affected
  Constraints
  <=5.3.2
- Version
  5.4.0
  Status
  affected
  Constraints
  -
Vendor Fortinet Product FortiDDoS-CM Default
unaffected
- Version
  4.7.0
  Status
  affected
  Constraints
  -
- Version
  5.0.0
  Status
  affected
  Constraints
  -
- Version
  5.1.0
  Status
  affected
  Constraints
  -
- Version
  5.2.0
  Status
  affected
  Constraints
  -
- Version
  5.3.0
  Status
  affected
  Constraints
  -
Vendor Fortinet Product FortiNDR Default
unaffected
- Version
  1.1.0
  Status
  affected
  Constraints
  -
- Version
  1.2.0
  Status
  affected
  Constraints
  -
- Version
  1.3.0
  Status
  affected
  Constraints
  <=1.3.1
- Version
  1.4.0
  Status
  affected
  Constraints
  -
- Version
  1.5.0
  Status
  affected
  Constraints
  <=1.5.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fortinet

FortiDDoS

unaffected

Version	Status	Constraints
4.4.0	affected	<=4.4.2
4.5.0	affected	-
4.6.0	affected	-
4.7.0	affected	-
5.0.0	affected	-
5.1.0	affected	-
5.2.0	affected	-
5.3.0	affected	<=5.3.2
5.4.0	affected	-

Fortinet

FortiDDoS-CM

unaffected

Version	Status	Constraints
4.7.0	affected	-
5.0.0	affected	-
5.1.0	affected	-
5.2.0	affected	-
5.3.0	affected	-

Fortinet

FortiNDR

unaffected

Version	Status	Constraints
1.1.0	affected	-
1.2.0	affected	-
1.3.0	affected	<=1.3.1
1.4.0	affected	-
1.5.0	affected	<=1.5.3

Remediation

Vendor solution

Please upgrade to FortiMail versions 6.0.10 or above. Please upgrade to FortiMail versions 6.2.5 or above. Please upgrade to FortiMail versions 6.4.2 or above.