CVE-2020-6648

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-6648
A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the "diag sys ha checksum show" command.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://www.fortiguard.com/psirt/FG-IR-20-009 Vendor Advisory
https://www.fortiguard.com/psirt/FG-IR-20-236 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
History

15 Jun 2022, 03:18

Type Values Removed Values Added
CPE cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*
First Time Fortinet fortiproxy
References (CONFIRM) https://www.fortiguard.com/psirt/FG-IR-20-236 - (CONFIRM) https://www.fortiguard.com/psirt/FG-IR-20-236 - Vendor Advisory
References (CONFIRM) https://www.fortiguard.com/psirt/FG-IR-20-009 - Broken Link (CONFIRM) https://www.fortiguard.com/psirt/FG-IR-20-009 - Vendor Advisory

11 Mar 2021, 21:15

Type Values Removed Values Added
Summary A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the "diag sys ha checksum show" command. A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the "diag sys ha checksum show" command.

11 Mar 2021, 20:15

Type Values Removed Values Added
References
  • (CONFIRM) https://www.fortiguard.com/psirt/FG-IR-20-236 -
Summary A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and below may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the "diag sys ha checksum show" command. A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the "diag sys ha checksum show" command.
Information

Published : 2020-10-21 14:15

Updated : 2023-12-10 13:41

NVD link : CVE-2020-6648

Mitre link : CVE-2020-6648

CVE.ORG link : CVE-2020-6648

JSON object : View

Products Affected

fortinet

  • fortiproxy
  • fortios
CWE
CWE-312

Cleartext Storage of Sensitive Information