Sensitive Information Disclosure in Fortinet FortiAuthenticator
CVE-2015-1456

Currently unrated

Key Information:

Vendor
Fortinet
Status
Fortiauthenticator
Vendor
CVE Published:
3 February 2015

Summary

Fortinet FortiAuthenticator 3.0.0 has a vulnerability that allows the storage of PostgreSQL usernames and passwords in cleartext format. This issue permits unauthorized access to sensitive information via logs located at debug/startup/. Remote administrators can exploit this flaw to gain critical insights into credentials, potentially compromising security and leading to unauthorized access to affected systems.

References

http://packetstormsecurity.com/files/130156/Fortinet-Fort...
x_refsource_MISC
http://www.securityfocus.com/bid/72378
vdb-entryx_refsource_BID
http://www.fortiguard.com/advisory/FG-IR-15-003/
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.