CVE-2024-21754

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21754
A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file.

4.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://fortiguard.fortinet.com/psirt/FG-IR-23-423 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
History

04 Oct 2024, 14:13

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 1.8 		v2 : unknown
v3 : 4.4
References () https://fortiguard.fortinet.com/psirt/FG-IR-23-423 - () https://fortiguard.fortinet.com/psirt/FG-IR-23-423 - Vendor Advisory
First Time Fortinet
Fortinet fortios
Fortinet fortiproxy
CPE cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

13 Jun 2024, 18:36

Type Values Removed Values Added
Summary
  • (es) Un uso de hash de contraseña con vulnerabilidad de esfuerzo computacional insuficiente [CWE-916] que afecta a FortiOS versión 7.4.3 e inferior, 7.2 todas las versiones, 7.0 todas las versiones, 6.4 todas las versiones y FortiProxy versión 7.4.2 e inferior, 7.2 todas las versiones, 7.0 todas versiones, 2.0, todas las versiones pueden permitir que un atacante privilegiado con perfil de superadministrador y acceso CLI pueda descifrar el archivo de copia de seguridad.

11 Jun 2024, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-11 15:16

Updated : 2024-10-04 14:13

NVD link : CVE-2024-21754

Mitre link : CVE-2024-21754

CVE.ORG link : CVE-2024-21754

JSON object : View

Products Affected

fortinet

  • fortios
  • fortiproxy
CWE
CWE-916

Use of Password Hash With Insufficient Computational Effort