A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to information disclosure via modification of LDAP server IP to point to a malicious server.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-257 | Information disclosure |
Type: CWE
Description: Information disclosure
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 3.1 | 2.1 | LOW | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:C |
Version: 3.1
Base score: 2.1
Base severity: LOW
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:C