Fortinet FortiAnalyzer 5.0.x < 5.0.8 Alert Email Plaintext Password Disclosure

low Nessus Plugin ID 84920

Language:

Synopsis

The remote host is potentially affected by an information disclosure vulnerability.

Description

The version of Fortinet FortiAnalyzer running on the remote host is 5.0.x prior to 5.0.8. It is, therefore, potentially affected by an information disclosure vulnerability due to passwords being printed in plaintext by the 'Alert email debug' feature. This allows a local attacker to view the passwords in the log when the 'Alert email debug' feature is enabled.

Note that Nessus has not tested for this issue or the host configuration but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Fortinet FortiAnalyzer 5.0.8 or later.

Plugin Details

Severity: Low

ID: 84920

File Name: fortianalyzer_5_0_8.nasl

Version: 1.6

Type: local

Family: CGI abuses

Published: 7/22/2015

Updated: 1/19/2021

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.7

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: cpe:/o:fortinet:fortianalyzer_firmware

Required KB Items: Settings/ParanoidReport, Host/Fortigate/model, Host/Fortigate/version

Patch Publication Date: 2/4/2015

Vulnerability Publication Date: 2/4/2015

Detections

Analytics