Vulnerability Intelligence Report
CVE-2021-24008
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file.
No Active Exploit Signals
CVSS Base Score
5.0
MEDIUM
Exploitability:3.9
Impact Score:1.5
EPSS Probability:0.45%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-200 ↗Information disclosure
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Fortinet | FortiDDoS | 5.4.0 (affected), 5.3.0 <= 5.3.2 (affected), 5.2.0 (affected), 5.1.0 (affected), 5.0.0 (affected), 4.7.0 (affected), 4.6.0 (affected), 4.5.0 (affected), 4.4.0 <= 4.4.2 (affected) |
| Fortinet | FortiNDR | 1.5.0 <= 1.5.3 (affected), 1.4.0 (affected), 1.3.0 <= 1.3.1 (affected), 1.2.0 (affected), 1.1.0 (affected) |
| Fortinet | FortiDDoS-CM | 5.3.0 (affected), 5.2.0 (affected), 5.1.0 (affected), 5.0.0 (affected), 4.7.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.448%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Fortinet, Inc. · Vendor · USA |
| Reserved | 2021-01-13T21:23:47 |
| Published | 2025-03-28T10:13:32 |
| Last Updated | 2025-03-28T13:39:11 |
Community Chatter & Buzz