Lucene search

FortinetCVELIST:CVE-2021-24005

HistoryJul 06, 2021 - 10:56 a.m.

CVE-2021-24005

2021-07-0610:56:12

fortinet

www.cve.org

fortiauthenticator

cryptographic keys

configuration files

debug logs

cve-2021-24005

sensitive data

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

7.7

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow an attacker with access to the files or the CLI configuration to decrypt the sensitive data, via knowledge of the hard-coded key.

CNA Affected

[
  {
    "product": "FortiAuthenticator",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiAuthenticator versions before 6.3.0."
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-20-049

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

7.7

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

Related for CVELIST:CVE-2021-24005