Incorrect default permissions in Fortinet, FortiOS



Published: 2020-01-23 | Updated: 2020-08-08
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2019-5593
CWE-ID CWE-276
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe
FortiOS
Operating systems & Components / Operating system

Vendor Fortinet, Inc

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Incorrect default permissions

EUVDB-ID: #VU34856

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-5593

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local authenticated user to gain access to sensitive information.

Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or for user uploaded local certificates via setting an empty password in FortiOS 6.2.1, 6.2.0, 6.0.6 and below.

Mitigation

Install update from vendor's website.

Vulnerable software versions

FortiOS: 6.2.0

External links

http://fortiguard.com/psirt/FG-IR-19-134


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###