Description
Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sensitive information by reading the log at debug/startup/.
References (4)
Core 4
Core References
Exploit, Third Party Advisory x_refsource_misc
http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/72378
Vendor Advisory x_refsource_confirm
http://www.fortiguard.com/advisory/FG-IR-15-003/
Vendor Advisory x_refsource_misc
http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf
Scores
EPSS
0.0027
EPSS Percentile
50.4%
Details
CWE
CWE-200
Status
published
Products (1)
fortinet/fortiauthenticator
3.0.0
Published
Feb 03, 2015
Tracked Since
Feb 18, 2026