CVE-2019-17655: fortinet fortinet fortios and fortiproxy

Vulnerability summary

CVE-2019-17655 is a high (CVSS 7.5) vulnerability in fortinet fortinet fortios and fortiproxy. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 62% of scored vulnerabilities.

Timeline

1. 16-06-2020
   PublishedVulnerability first disclosed.
2. 25-10-2024
   Last modifiedVulnerability information updated.

Description

A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on the targeted device's system.

• CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.