CVE-2020-29010

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-29010
An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay allow remote authenticated actors to read the SSL VPN events log entries of users in other VDOMs by executing "get vpn ssl monitor" from the CLI. The sensitive data includes usernames, user groups, and IP address.

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://fortiguard.fortinet.com/psirt/FG-IR-20-103 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
History

24 Jul 2025, 20:15

Type Values Removed Values Added
First Time Fortinet fortios
Fortinet
Summary
  • (es) La exposición de información confidencial a una vulnerabilidad de un agente no autorizado en FortiOS versión 6.2.4 y anteriores, y versión 6.0.10 y anteriores, podría permitir que agentes autenticados remotamente lean las entradas del registro de eventos de SSL VPN de usuarios en otros VDOM mediante la ejecución de "get vpn ssl monitor" desde la CLI. Los datos confidenciales incluyen nombres de usuario, grupos de usuarios y direcciones IP.
References () https://fortiguard.fortinet.com/psirt/FG-IR-20-103 - () https://fortiguard.fortinet.com/psirt/FG-IR-20-103 - Vendor Advisory
CPE cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

17 Mar 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-17 14:15

Updated : 2025-07-24 20:15

NVD link : CVE-2020-29010

Mitre link : CVE-2020-29010

CVE.ORG link : CVE-2020-29010

JSON object : View

Products Affected

fortinet

  • fortios
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor