CVE-2020-15942: [FortiWeb] Password set in scan profile visible in clear text
An information disclosure vulnerability in FortiWeb's Web Vulnerability Scan profile may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile.
Other sources
An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-15942?
CVE-2020-15942 is an information disclosure vulnerability in the Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5.
How can an attacker exploit CVE-2020-15942?
A remote authenticated attacker may exploit CVE-2020-15942 to read the password used by the FortiWeb scanner to access the device defined in the scan profile.
What is the severity of CVE-2020-15942?
The severity of CVE-2020-15942 is medium with a severity value of 6.5.
How can I fix CVE-2020-15942?
To fix CVE-2020-15942, it is recommended to upgrade Fortinet's FortiWeb to version 6.2.4 or 6.3.5, depending on the affected version.
Where can I find more information about CVE-2020-15942?
More information about CVE-2020-15942 can be found at the following references: [FortiGuard Advisory](https://fortiguard.com/advisory/FG-IR-20-076) and [FortiGuard PSIRT](https://www.fortiguard.com/psirt/FG-IR-20-076).