CVE-2019-5591: FG default configuration is not secure/ By default, FG does not verify LDAP server identity
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
Other sources
Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update FortiOS to verify the LDAP server identity (the finding states that by default FortiOS does not verify LDAP server identity; enable verification to prevent LDAP impersonation on the same subnet).
FortiOS (LDAP client) LDAP server identity verification = enable/verify
Event History
Frequently Asked Questions
What is the severity of CVE-2019-5591?
CVE-2019-5591 is considered a medium severity vulnerability due to its potential for information interception.
How do I fix CVE-2019-5591?
To mitigate CVE-2019-5591, it is recommended to change the default configuration of FortiOS and secure the LDAP server settings.
Who is affected by CVE-2019-5591?
CVE-2019-5591 affects Fortinet FortiOS versions up to and including 6.2.0.
Can CVE-2019-5591 be exploited remotely?
No, CVE-2019-5591 requires the attacker to be on the same subnet to exploit the vulnerability.
What type of attack does CVE-2019-5591 enable?
CVE-2019-5591 allows an unauthenticated attacker to impersonate the LDAP server and intercept sensitive information.