Lucene search

FortinetCVE-2020-6648

HistoryOct 21, 2020 - 2:15 p.m.

CVE-2020-6648

2020-10-2114:15:20

CWE-312

fortinet

web.nvd.nist.gov

cve-2020-6648

cleartext storage

fortios

fortiproxy

authentication

sensitive information

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the “diag sys ha checksum show” command.

Affected configurations

Nvd

Node

fortinetfortiproxyRange<1.2.10

fortinetfortiproxyMatch2.0.0

fortinetfortiosRange<6.0.12

fortinetfortiosRange6.2.0–6.2.5

VendorProductVersionCPE
fortinetfortiproxy*cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
fortinetfortiproxy2.0.0cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*
fortinetfortios*cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiproxy	*	cpe:2.3:a:fortinet:fortiproxy::::::::
fortinet	fortiproxy	2.0.0	cpe:2.3:a:fortinet:fortiproxy:2.0.0:::::::*
fortinet	fortios	*	cpe:2.3:o:fortinet:fortios::::::::

CNA Affected

[
  {
    "product": "FortiGate and FortiProxy",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiOS versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier."
      }
    ]
  }
]

References

www.fortiguard.com/psirt/FG-IR-20-009

www.fortiguard.com/psirt/FG-IR-20-236

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Related for CVE-2020-6648