FortiGate & FortiADC - Read-only admins can obtain the LDAP credentials configured in the FortiGate and FortiADC using the LDAP test connectivity feature
FortiGate's and FortiADC's read-only admins are able to point an LDAP server connectivity test request to a rogue LDAP server instead of the configured one, in order to obtain the LDAP server login credentials configured in the FortiGate.
Affected ProductsFortiOS 6.0.2 and below
Upgrade to FortiOS 6.0.3 or upcoming 6.2.0
Please upgrade to FortiADC 6.1.1 or above.
Please upgrade to FortiADC 6.0.2 or above.
Please upgrade to FortiADC 5.4.5 or above.