by Kastro CVE-2023-26204
Fortinet FortiSIEM — A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all vers…
Description · from the CVE record
A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may allow an attacker able to access user DB content to impersonate any admin user on the device GUI.
Affected
ProductAffectedFixed inSource
FortiSIEM6.7.0 – 6.7.5–CNA
FortiSIEM6.6.0 – 6.6.3–CNA
FortiSIEM6.5.0 – 6.5.1–CNA
FortiSIEM6.4.0 – 6.4.2–CNA
FortiSIEM6.3.0 – 6.3.3–CNA
FortiSIEM6.2.0 – 6.2.1–CNA
FortiSIEM6.1.0 – 6.1.2–CNA
FortiSIEM5.4.0–CNA
FortiSIEM5.3.0 – 5.3.3–CNA
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
fortinet (CNA)3.6CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial