CVE-2015-1456: Infoleak
Published Feb 3, 2015
·Updated
Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sensitive information by reading the log at debug/startup/.
Affected Software
1 affected component
Fortinet FortiAuthenticator=3.0.0
Event History
Feb 3, 2015
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-1456?
CVE-2015-1456 has been classified as a medium severity vulnerability due to the exposure of sensitive information.
2
How do I fix CVE-2015-1456?
To fix CVE-2015-1456, upgrade Fortinet FortiAuthenticator to a version that does not log PostgreSQL usernames and passwords in cleartext.
3
What types of information are compromised in CVE-2015-1456?
CVE-2015-1456 compromises PostgreSQL usernames and passwords that are logged in cleartext.
4
Who is affected by CVE-2015-1456?
Users of Fortinet FortiAuthenticator version 3.0.0 are affected by CVE-2015-1456.
5
Can CVE-2015-1456 be exploited remotely?
Yes, CVE-2015-1456 can potentially be exploited by remote administrators who have access to the logs.