CVE-2018-13378

An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code.

CVSS v3 7.2 HIGH
CVSS v2.0 4.0 MEDIUM

7.2^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://fortiguard.com/advisory/FG-IR-18-382	Third Party Advisory
https://fortiguard.com/advisory/FG-IR-18-382	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:46

Type	Values Removed	Values Added
References	~~() https://fortiguard.com/advisory/FG-IR-18-382 - Third Party Advisory~~	() https://fortiguard.com/advisory/FG-IR-18-382 - Third Party Advisory

Information

Published : 2019-04-17 15:29

Updated : 2024-11-21 03:46

NVD link : CVE-2018-13378

Mitre link : CVE-2018-13378

CVE.ORG link : CVE-2018-13378

JSON object : View

Products Affected

fortinet

fortisiem

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2018-13378", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2019-04-17T15:29:00.437", "references": [{"url": "https://fortiguard.com/advisory/FG-IR-18-382", "tags": ["Third Party Advisory"], "source": "psirt@fortinet.com"}, {"url": "https://fortiguard.com/advisory/FG-IR-18-382", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code."}, {"lang": "es", "value": "Una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en Fortinet FortiSIEM versi\u00f3n 5.2.0 y versiones anteriores, revela la contrase\u00f1a de texto plano del servidor LDAP por medio del c\u00f3digo fuente HTML."}], "lastModified": "2024-11-21T03:46:59.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C47F7C1E-EA58-41E9-87F9-7EE3F12E8B13", "versionEndIncluding": "5.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}