Lucene search

FortinetCVE-2019-6693

HistoryNov 21, 2019 - 4:15 p.m.

CVE-2019-6693

2019-11-2116:15:13

CWE-798

fortinet

web.nvd.nist.gov

cve-2019-6693

fortios

configuration backup

hard-coded key

cryptographic key

sensitive data

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

35.4%

JSON

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users’ passwords (except the administrator’s password), private keys’ passphrases and High Availability password (when set).

Affected configurations

Nvd

Node

fortinetfortiosRange≤5.6.10

fortinetfortiosRange6.0.0–6.0.6

fortinetfortiosMatch6.2.0

VendorProductVersionCPE
fortinetfortios*cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
fortinetfortios6.2.0cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortios	*	cpe:2.3:o:fortinet:fortios::::::::
fortinet	fortios	6.2.0	cpe:2.3:o:fortinet:fortios:6.2.0:::::::*

CNA Affected

[
  {
    "product": "FortiGate",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "5.6.9 and below"
      },
      {
        "status": "affected",
        "version": "6.0.5 and below"
      },
      {
        "status": "affected",
        "version": "6.2.0"
      }
    ]
  }
]

References

fortiguard.com/advisory/FG-IR-19-007

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

35.4%

JSON

Related for CVE-2019-6693