description: A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an attacker already in possession of the password store to decrypt the passwords by means of precomputed tables.
problem types: Information disclosure
affected:
{
product: Fortinet FortiPortal
vendor: Fortinet
versions:
status: affected, version: FortiPortal 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: HIGH
remediationLevel: WORKAROUND
reportConfidence: CONFIRMED
scope: CHANGED
temporalScore: 5.5
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N/E:P/RL:W/RC:C
version: 3.1
]