Medium severity · published Mar 28, 2025
CVE-2021-24008
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version…
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fortiddos · Fortinet
4.4.0 before 5.4.3 · source: NVD
FO
Fortiddos-cm · Fortinet
4.7.0; 5.0.0; 5.1.0; 5.2.0; 5.3.0 · source: NVD
FO
Fortimail · Fortinet
6.0.0 before 6.0.10; 6.2.0 before 6.2.5; 6.4.0 before 6.4.2 · source: NVD
FO
Fortirecorder · Fortinet
6.0.0 before 6.0.4 · source: NVD
FO
Fortivoice · Fortinet
6.0.0 before 6.0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24008
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24008
Vendor Advisory
https://fortiguard.fortinet.com/psirt/FG-IR-20-105
More from Fortiddos
8.1
CVE-2022-29060
A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker…
7.8
CVE-2022-27486
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through…
7.8
CVE-2022-40679
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6.2.0 through 6.2.4,…
6.1
CVE-2022-23439
A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host`…