PT-2015-5296 · Fortinet · Fortiauthenticator

Published 2015-02-03 · Updated 2015-02-19 · CVE-2015-1456

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiAuthenticator version 3.0.0

Description The issue allows remote administrators to obtain sensitive information, specifically PostgreSQL usernames and passwords, which are logged in cleartext. This can be done by reading the log at debug/startup/.

Recommendations For Fortinet FortiAuthenticator version 3.0.0, consider restricting access to the log files at debug/startup/ to minimize the risk of exploitation. As a temporary workaround, limit the privileges of remote administrators to reduce the potential impact. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-1456

Affected Products

Fortiauthenticator

References · 5

• http://fortiguard.com/advisory/FG-IR-15-003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1456 · Security Note
• http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html · Note
• http://security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf · Note
• http://securityfocus.com/bid/72378 · Note