A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and 5.4.x before 5.4.2 GA may have access to read-write administrators password hashes (not including super-admins) stored on the appliance via the webui REST API, and may therefore be able to crack them.
References
Link | Resource |
---|---|
http://fortiguard.com/advisory/FG-IR-16-050 | Not Applicable |
http://www.securityfocus.com/bid/94690 | Third Party Advisory VDB Entry |
http://www.securitytracker.com/id/1037394 | |
http://fortiguard.com/advisory/FG-IR-16-050 | Not Applicable |
http://www.securityfocus.com/bid/94690 | Third Party Advisory VDB Entry |
http://www.securitytracker.com/id/1037394 |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 02:58
Type | Values Removed | Values Added |
---|---|---|
References | () http://fortiguard.com/advisory/FG-IR-16-050 - Not Applicable | |
References | () http://www.securityfocus.com/bid/94690 - Third Party Advisory, VDB Entry | |
References | () http://www.securitytracker.com/id/1037394 - |
Information
Published : 2017-03-30 14:59
Updated : 2024-11-21 02:58
NVD link : CVE-2016-7542
Mitre link : CVE-2016-7542
CVE.ORG link : CVE-2016-7542
JSON object : View
Products Affected
fortinet
- fortios
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor