FortiOS - Plain-text credentials in GET request via SSL VPN web portal

A use of GET request method with sensitive query strings vulnerability [CWE-598] in the FortiOS SSL VPN component may allow an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET requests to those services (found in logs, referers, caches, etc...)

attacker credentials cwe fortios found may passwords plaintext portal query rdp remote services request requests sensitive services ssl ssl vpn strings text vnc vpn vulnerability web