{"timestamp":"2024-10-24T20:09:47.722910Z","id":"CVE-2019-17655","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Fortinet","product":"Fortinet FortiOS and FortiProxy","versions":[{"version":"FortiOS 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier","status":"affected"}]}]

https://fortiguard.com/psirt/FG-IR-19-217

https://fortiguard.com/psirt/FG-IR-20-224

A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy  2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on the targeted device's system.

A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on the targeted device's system.

A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 to 6.2.2, 6.0.9 and below may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on the targeted device's system.

A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy  2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on the targeted device's system.

Fortinet, Inc. AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

https://fortiguard.com/psirt/FG-IR-20-224 [No Types Assigned]

A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.2 and below may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on the targeted device's system.

A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 to 6.2.2, 6.0.9 and below may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on the targeted device's system.

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NIST (AV:N/AC:L/Au:N/C:P/I:N/A:N)

NIST CWE-312

OR
     *cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* versions up to (excluding) 6.2.3

https://fortiguard.com/psirt/FG-IR-19-217 No Types Assigned

https://fortiguard.com/psirt/FG-IR-19-217 Vendor Advisory