PT-2019-4459 · Fortinet · Fortios

Published 2019-11-14 · Updated 2021-07-21 · CVE-2019-5593

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 5.6.10 and below FortiOS versions 6.0.0 through 6.0.6 FortiOS version 6.2.0 FortiOS version 6.2.1

Description The issue is related to improper permission or value checking in the CLI console, which may allow a non-privileged user to obtain plain text private keys of the system's built-in local certificates or user-uploaded local certificates. This can be achieved by unsetting the keys encryption password or by setting an empty password. Additionally, backed up config files can be restored onto a vulnerable version of FortiOS to obtain the plaintext versions of local certificates private keys encrypted in those config files.

Recommendations For FortiOS versions 5.6.10 and below, update to a version that includes a fix for this issue. For FortiOS versions 6.0.0 through 6.0.6, update to a version that includes a fix for this issue. For FortiOS version 6.2.0, update to a version that includes a fix for this issue. For FortiOS version 6.2.1, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the CLI console to minimize the risk of exploitation. Avoid using empty passwords for user-uploaded local certificates and ensure that keys encryption passwords are properly set.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-264

Related Identifiers

BDU:2020-00246

CVE-2019-5593

Affected Products

Fortios

References · 4

• https://fortiguard.com/psirt/FG-IR-19-134 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5593 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5593 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00246 · Security Note