Inter ADOM information leakage

Summary

An improper access control vulnerability [CWE-284] in FortiManager and FortiAnalyzer management interface may allow a remote and authenticated admin user assigned to a specific ADOM to access other ADOMs information such as device information and dashboard information.

Affected Products

FortiManager version 7.2.0
FortiManager version 7.0.0 through 7.0.3
FortiManager version 6.4.0 through 6.4.7
FortiManager 6.2 all versions
FortiManager 6.0 all versions
FortiAnalyzer version 7.2.0
FortiAnalyzer version 7.0.0 through 7.0.3
FortiAnalyzer version 6.4.0 through 6.4.8
FortiAnalyzer 6.2 all versions
FortiAnalyzer 6.0 all versions

Solutions

Please upgrade to FortiManager version 7.2.1 or above
Please upgrade to FortiManager version 7.0.4 or above
Please upgrade to FortiManager version 6.4.8 or above
Please upgrade to FortiAnalyzer version 7.2.1 or above
Please upgrade to FortiAnalyzer version 7.0.4 or above
Please upgrade to FortiAnalyzer version 6.4.9 or above

Acknowledgement

Fortinet is pleased thank Abdulmohsen Nasser Alotaibi, from DEEM @ SDAIA for reporting this vulnerability under responsible disclosure.

Timeline

2022-09-06: Initial publication