Details of VAR-201911-0300

ID

VAR-201911-0300

CVE

CVE-2019-6693

TITLE

FortiOS Configuration Backup File Uses Hard-coded Credentials Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-012406

DESCRIPTION

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set). Fortinet FortiOS is a set of security operating system dedicated to the FortiGate network security platform developed by Fortinet. The system provides users with various security functions such as firewall, anti-virus, IPSec/SSLVPN, Web content filtering and anti-spam. Fortinet FortiOS 5.6.10 and earlier versions, 6.0.6 and earlier versions, and 6.2.0 versions have security vulnerabilities. Fortinet FortiOS is prone to a hardcoded cryptographic key vulnerability. Successful exploits will allow malicious users to obtain sensitive information that may aid in further attacks

Trust: 1.8

sources: NVD: CVE-2019-6693 // JVNDB: JVNDB-2019-012406 // VULHUB: VHN-158128 // VULMON: CVE-2019-6693

AFFECTED PRODUCTS

vendor:	fortinet	model:	fortios	scope:	lte	version:	5.6.10	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	gte	version:	6.0.0	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	eq	version:	6.2.0	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	lte	version:	6.0.6	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2019-012406 // NVD: CVE-2019-6693

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-6693
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-6693
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201911-1195
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-158128
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2019-6693
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-6693
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-158128
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-6693
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2019-6693
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-158128 // VULMON: CVE-2019-6693 // JVNDB: JVNDB-2019-012406 // CNNVD: CNNVD-201911-1195 // NVD: CVE-2019-6693

PROBLEMTYPE DATA

problemtype:

CWE-798

Trust: 1.9

sources: VULHUB: VHN-158128 // JVNDB: JVNDB-2019-012406 // NVD: CVE-2019-6693

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201911-1195

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201911-1195

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-012406

PATCH

title:	FG-IR-19-007	url:	https://fortiguard.com/advisory/FG-IR-19-007	Trust: 0.8
title:	Fortinet FortiOS Repair measures for trust management problem vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=103775	Trust: 0.6
title:	CVE-2019-6693	url:	https://github.com/gquere/CVE-2019-6693	Trust: 0.1

sources: VULMON: CVE-2019-6693 // JVNDB: JVNDB-2019-012406 // CNNVD: CNNVD-201911-1195

EXTERNAL IDS

db:	NVD	id:	CVE-2019-6693	Trust: 2.6
db:	JVNDB	id:	JVNDB-2019-012406	Trust: 0.8
db:	CNNVD	id:	CNNVD-201911-1195	Trust: 0.7
db:	AUSCERT	id:	ESB-2019.4387.3	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.4387	Trust: 0.6
db:	VULHUB	id:	VHN-158128	Trust: 0.1
db:	VULMON	id:	CVE-2019-6693	Trust: 0.1

sources: VULHUB: VHN-158128 // VULMON: CVE-2019-6693 // JVNDB: JVNDB-2019-012406 // CNNVD: CNNVD-201911-1195 // NVD: CVE-2019-6693

REFERENCES

url:	https://fortiguard.com/advisory/fg-ir-19-007	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2019-6693	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6693	Trust: 0.8
url:	https://fortiguard.com/psirt/fg-ir-19-007	Trust: 0.6
url:	https://vigilance.fr/vulnerability/fortios-information-disclosure-via-backup-hard-coded-cryptographic-key-30915	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2019.4387.3/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2019.4387/	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/798.html	Trust: 0.1
url:	https://github.com/gquere/cve-2019-6693	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/110914	Trust: 0.1

sources: VULHUB: VHN-158128 // VULMON: CVE-2019-6693 // JVNDB: JVNDB-2019-012406 // CNNVD: CNNVD-201911-1195 // NVD: CVE-2019-6693

SOURCES

db:	VULHUB	id:	VHN-158128
db:	VULMON	id:	CVE-2019-6693
db:	JVNDB	id:	JVNDB-2019-012406
db:	CNNVD	id:	CNNVD-201911-1195
db:	NVD	id:	CVE-2019-6693

LAST UPDATE DATE

2024-08-14T13:44:36.725000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-158128	date:	2019-11-27T00:00:00
db:	VULMON	id:	CVE-2019-6693	date:	2019-11-27T00:00:00
db:	JVNDB	id:	JVNDB-2019-012406	date:	2019-12-02T00:00:00
db:	CNNVD	id:	CNNVD-201911-1195	date:	2020-07-01T00:00:00
db:	NVD	id:	CVE-2019-6693	date:	2019-11-27T04:23:39.017

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-158128	date:	2019-11-21T00:00:00
db:	VULMON	id:	CVE-2019-6693	date:	2019-11-21T00:00:00
db:	JVNDB	id:	JVNDB-2019-012406	date:	2019-12-02T00:00:00
db:	CNNVD	id:	CNNVD-201911-1195	date:	2019-11-20T00:00:00
db:	NVD	id:	CVE-2019-6693	date:	2019-11-21T16:15:13.173