This vulnerability in Fortinet FortiOS allows an attacker with high privileges to cause information disclosure by modifying the LDAP server IP address to redirect to a malicious server. The root cause is that passwords are stored in a recoverable format in affected versions, including FortiOS 6.4 all versions, 7.0 all versions, 7.2 all versions, and 7.4.0 through 7.4.8. The CVSS 3.1 base score is 2.1, reflecting low severity, with an attack vector requiring local access and high privileges. The vendor has assigned a remediation level of workaround, indicating no official patch is currently available.

An attacker with high privileges on the system can modify the LDAP server IP configuration to redirect authentication requests to a malicious server, potentially exposing stored passwords that are kept in a recoverable format. The impact is limited to information disclosure with no integrity or availability impact. The low CVSS score reflects the limited scope and required privileges for exploitation.

The vendor has assigned a remediation level of workaround, indicating no official patch is currently available. Users should apply any recommended configuration workarounds provided by Fortinet to mitigate the risk. Monitoring and restricting administrative access to prevent unauthorized modification of LDAP server settings is advised. Patch status is not yet confirmed — check the Fortinet advisory for current remediation guidance.