PT-2021-5414 · Fortinet · Fortisiem Windows Agent

Published 2021-11-02 · Updated 2022-05-03 · CVE-2021-41023

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiSIEM Windows Agent versions 4.1.4 and below

Description The issue is related to the storage of credentials in plaintext in log files, allowing an authenticated user to disclose the agent password. This could potentially enable an attacker to gain unauthorized access to protected information.

Recommendations For Fortinet FortiSIEM Windows Agent versions 4.1.4 and below, consider disabling the logging of credentials to the log files as a temporary workaround until a patch is available. Restrict access to the log files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-522

CWE-312

CWE-256

Related Identifiers

BDU:2021-06257

CVE-2021-41023

Affected Products

Fortisiem Windows Agent

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-41023 · Security Note
• https://fortiguard.com/advisory/FG-IR-21-175 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41023 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06257 · Security Note
• https://t.me/cvenotify/22974 · Telegram Post
• https://t.me/cvenotify/22894 · Telegram Post
• https://t.me/cibsecurity/31631 · Telegram Post