PT-2020-19203 · Fortinet · Fortigate+2

Published 2020-10-19 · Updated 2022-06-15 · CVE-2020-6648

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.2.4 and earlier FortiProxy versions 2.0.0, 1.2.9 and earlier

Description A cleartext storage of sensitive information issue in the command line interface may allow an authenticated attacker to obtain sensitive information, such as user passwords, by connecting to the FortiGate CLI and executing the "diag sys ha checksum show" command.

Recommendations For FortiOS versions 6.2.4 and earlier, update to a version later than 6.2.4 to resolve the issue. For FortiProxy versions 2.0.0, 1.2.9 and earlier, update to a version later than 1.2.9 to resolve the issue. As a temporary workaround, consider restricting access to the FortiGate CLI to minimize the risk of exploitation.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2020-6648

Affected Products

Fortigate

Fortios

Fortiproxy

References · 6

• https://osv.dev/vulnerability/CVE-2020-6648 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-20-236 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6648 · Security Note
• https://fortiguard.com/psirt/FG-IR-20-009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6648 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-20-009 · Note