What’s Vulnerable › Vulnerabilities
CVE-2021-24008
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-03-28 · updated 2026-06-17
- Weakness: CWE-200
Description
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file.
Affected products
- Fortinet FortiDDoS: from 4.4.0 before 5.4.3 — fixed in 5.4.3
- Fortinet FortiDDoS-CM: 4.7.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0
- Fortinet FortiMail: from 6.0.0 before 6.0.10; from 6.2.0 before 6.2.5; from 6.4.0 before 6.4.2 — fixed in 6.0.10, 6.2.5, 6.4.2
- Fortinet FortiRecorder: from 6.0.0 before 6.0.4 — fixed in 6.0.4
- Fortinet FortiVoice: from 6.0.0 before 6.0.7 — fixed in 6.0.7
How to fix
Upgrade to a fixed version: Fortinet FortiDDoS 5.4.3; Fortinet FortiMail 6.0.10, 6.2.5, 6.4.2; Fortinet FortiRecorder 6.0.4; Fortinet FortiVoice 6.0.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2021-24008 or the next vulnerability affects your stack