PT-2020-6659 · Fortinet · Fortiweb

Published 2020-02-18 · Updated 2021-07-21 · CVE-2019-16157

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.2.0 and earlier

Description The issue is related to an information exposure vulnerability that may allow an authenticated user to view sensitive information being logged via diagnose debug commands. This vulnerability is associated with a lack of protection for internal data. An attacker could exploit this vulnerability to disclose protected information using diagnose debug commands.

Recommendations For FortiWeb versions 6.2.0 and earlier, consider restricting access to the diagnose debug commands until a patch is available. As a temporary workaround, limit the use of diagnose debug commands to minimize the risk of sensitive information exposure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Information Disclosure

Weakness Enumeration

CWE-532

CWE-200

Related Identifiers

BDU:2022-03132

CVE-2019-16157

Affected Products

Fortiweb

References · 6

• https://bdu.fstec.ru/vul/2022-03132 · Security Note
• https://fortiguard.com/advisory/FG-IR-19-269 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16157 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16157 · Vendor Advisory
• https://t.me/cvenotify/1634 · Telegram Post
• https://fortiguard.com/psirt/FG-IR-19-269 · Note