PT-2015-5296 · Fortinet · Fortiauthenticator

Publicado 2015-02-03 · Atualizado 2015-02-19 · CVE-2015-1456

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiAuthenticator version 3.0.0

Description The issue allows remote administrators to obtain sensitive information, specifically PostgreSQL usernames and passwords, which are logged in cleartext. This can be done by reading the log at debug/startup/.

Recommendations For Fortinet FortiAuthenticator version 3.0.0, consider restricting access to the log files at debug/startup/ to minimize the risk of exploitation. As a temporary workaround, limit the privileges of remote administrators to reduce the potential impact. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-1456

Produtos afetados

Fortiauthenticator

Referências · 5

• http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html · Nota
• http://fortiguard.com/advisory/FG-IR-15-003 · Aviso do Fabricante
• http://security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf · Nota
• http://securityfocus.com/bid/72378 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1456 · Nota de Segurança