Sign-up

ID

VAR-202006-0825


CVE

CVE-2019-17655


TITLE

FortiOS Vulnerability in plaintext storage of important information in

Trust: 0.8

sources: JVNDB: JVNDB-2019-015698

DESCRIPTION

A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on the targeted device's system. FortiOS There is a vulnerability in plaintext storage of important information.Information may be obtained. Fortinet FortiOS is a set of security operating system dedicated to the FortiGate network security platform developed by Fortinet. The system provides users with various security functions such as firewall, anti-virus, IPSec/SSLVPN, Web content filtering and anti-spam. An information disclosure vulnerability exists in Fortinet FortiOS versions 6.2.0 to 6.2.2 and 6.0.9 and earlier versions

Trust: 1.71

sources: NVD: CVE-2019-17655 // JVNDB: JVNDB-2019-015698 // VULHUB: VHN-149923

AFFECTED PRODUCTS

vendor:fortinetmodel:fortiosscope:ltversion:6.2.3

Trust: 1.0

vendor:fortinetmodel:fortiosscope:eqversion:6.2.0 から 6.2.2

Trust: 0.8

vendor:fortinetmodel:fortiosscope:eqversion:6.0.9

Trust: 0.8

sources: JVNDB: JVNDB-2019-015698 // NVD: CVE-2019-17655

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-17655
value: HIGH

Trust: 1.0

psirt@fortinet.com: CVE-2019-17655
value: MEDIUM

Trust: 1.0

NVD: JVNDB-2019-015698
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202001-1403
value: HIGH

Trust: 0.6

VULHUB: VHN-149923
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-17655
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2019-015698
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-149923
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-17655
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

psirt@fortinet.com: CVE-2019-17655
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: JVNDB-2019-015698
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-149923 // JVNDB: JVNDB-2019-015698 // CNNVD: CNNVD-202001-1403 // NVD: CVE-2019-17655 // NVD: CVE-2019-17655

PROBLEMTYPE DATA

problemtype:CWE-312

Trust: 1.9

sources: VULHUB: VHN-149923 // JVNDB: JVNDB-2019-015698 // NVD: CVE-2019-17655

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202001-1403

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-202001-1403

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-015698

PATCH
title:FG-IR-19-217url:https://fortiguard.com/psirt/FG-IR-19-217
Trust: 0.8
title:Fortinet FortiOS SSL VPN Repair measures for information disclosure vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=110692
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-015698 // 
            
            
            
            CNNVD: CNNVD-202001-1403

EXTERNAL IDS
db:NVDid:CVE-2019-17655
Trust: 2.5
db:JVNDBid:JVNDB-2019-015698
Trust: 0.8
db:CNNVDid:CNNVD-202001-1403
Trust: 0.7
db:AUSCERTid:ESB-2021.0775
Trust: 0.6
db:AUSCERTid:ESB-2020.0320
Trust: 0.6
db:AUSCERTid:ESB-2020.2230
Trust: 0.6
db:CNVDid:CNVD-2020-52693
Trust: 0.1
db:VULHUBid:VHN-149923
Trust: 0.1
sources:
            
            
            VULHUB: VHN-149923 // 
            
            
            
            JVNDB: JVNDB-2019-015698 // 
            
            
            
            CNNVD: CNNVD-202001-1403 // 
            
            
            
            NVD: CVE-2019-17655

REFERENCES
url:https://fortiguard.com/psirt/fg-ir-19-217
Trust: 2.3
url:https://fortiguard.com/psirt/fg-ir-20-224
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-17655
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-17655
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2020.0320/
Trust: 0.6
url:https://vigilance.fr/vulnerability/fortigate-ssl-vpn-privilege-escalation-via-credential-plaintext-storage-31441
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2020.2230/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.0775
Trust: 0.6
sources:
            
            
            VULHUB: VHN-149923 // 
            
            
            
            JVNDB: JVNDB-2019-015698 // 
            
            
            
            CNNVD: CNNVD-202001-1403 // 
            
            
            
            NVD: CVE-2019-17655

SOURCES
db:VULHUBid:VHN-149923
db:JVNDBid:JVNDB-2019-015698
db:CNNVDid:CNNVD-202001-1403
db:NVDid:CVE-2019-17655

LAST UPDATE DATE
2024-08-14T13:44:56.788000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-149923date:2020-06-29T00:00:00
db:JVNDBid:JVNDB-2019-015698date:2020-07-22T00:00:00
db:CNNVDid:CNNVD-202001-1403date:2021-03-10T00:00:00
db:NVDid:CVE-2019-17655date:2021-03-09T17:15:12.220

SOURCES RELEASE DATE
db:VULHUBid:VHN-149923date:2020-06-16T00:00:00
db:JVNDBid:JVNDB-2019-015698date:2020-07-22T00:00:00
db:CNNVDid:CNNVD-202001-1403date:2020-01-29T00:00:00
db:NVDid:CVE-2019-17655date:2020-06-16T21:15:10.313