CVE-2020-6648

A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the "diag sys ha checksum show" command.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:36

Type Values Removed Values Added
References () https://www.fortiguard.com/psirt/FG-IR-20-009 - Vendor Advisory () https://www.fortiguard.com/psirt/FG-IR-20-009 - Vendor Advisory
References () https://www.fortiguard.com/psirt/FG-IR-20-236 - Vendor Advisory () https://www.fortiguard.com/psirt/FG-IR-20-236 - Vendor Advisory
CVSS v2 : 4.0
v3 : 6.5
v2 : 4.0
v3 : 5.3

Information

Published : 2020-10-21 14:15

Updated : 2024-11-21 05:36


NVD link : CVE-2020-6648

Mitre link : CVE-2020-6648

CVE.ORG link : CVE-2020-6648


JSON object : View

Products Affected

fortinet

  • fortiproxy
  • fortios
CWE
CWE-312

Cleartext Storage of Sensitive Information