Cleartext Storage Vulnerability in FortiOS and FortiProxy by Fortinet
CVE-2020-6648

5.3MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortigate And Fortiproxy
Vendor
CVE Published:
21 October 2020

Summary

A vulnerability exists within FortiOS and FortiProxy that enables an authenticated user to access sensitive information stored in cleartext. By executing the command 'diag sys ha checksum show' through the FortiGate Command Line Interface (CLI), an attacker can retrieve sensitive user data including passwords. This puts the integrity and confidentiality of user accounts at risk, making remediation essential for affected systems.

Affected Version(s)

FortiGate and FortiProxy FortiOS versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier.

References

https://www.fortiguard.com/psirt/FG-IR-20-009
x_refsource_CONFIRM
https://www.fortiguard.com/psirt/FG-IR-20-236
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.