CVE-2020-6648

5.3MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortigate And Fortiproxy
Vendor
CVE Published:
21 October 2020

Summary

A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the "diag sys ha checksum show" command.

Affected Version(s)

FortiGate and FortiProxy FortiOS versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier.

References

https://www.fortiguard.com/psirt/FG-IR-20-009
x_refsource_CONFIRM
https://www.fortiguard.com/psirt/FG-IR-20-236
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.