FortiAIOps - Sensitive Information leak to an Unauthorized Actor

Summary

Multiple Exposure of sensitive information to an unauthorized actor vulnerabilities [CWE-200] may allow an authenticated attacker to retrieve sensitive information from the API endpoint or logs.

Acknowledgement

Internally discovered and reported by Shree Rawal and Jenny Ning of Fortinet PSIRT team.

Timeline

2024-07-09: Initial publication