description: A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may allow an attacker able to access user DB content to impersonate any admin user on the device GUI.
problem types: Improper access control
affected:
{
vendor: Fortinet
product: FortiSIEM
defaultStatus: unaffected
versions:
versionType: semver, version: 6.7.0, lessThanOrEqual: 6.7.5, status: affected
versionType: semver, version: 6.6.0, lessThanOrEqual: 6.6.3, status: affected
versionType: semver, version: 6.5.0, lessThanOrEqual: 6.5.1, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.2, status: affected
versionType: semver, version: 6.3.0, lessThanOrEqual: 6.3.3, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.1, status: affected
versionType: semver, version: 6.1.0, lessThanOrEqual: 6.1.2, status: affected
version: 5.4.0, status: affected
versionType: semver, version: 5.3.0, lessThanOrEqual: 5.3.3, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.6
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C
]
solutions: Please upgrade to FortiSIEM version 7.0.0 or above