Login Request a demo
Medium severity · published Nov 2, 2021
CVE-2020-15935
A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve some sensitive…
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve some sensitive information such as users LDAP passwords and RADIUS shared secret by deobfuscating the passwords entry fields.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fortiadc · Fortinet
5.0.0 through 5.4.3; 6.0.0 through 6.0.1 · source: NVD
Affected product
FO
Fortiadc
Fortinet
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15935
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15935
Vendor Advisory
https://fortiguard.com/advisory/FG-IR-20-044
More from Fortiadc
4.3
CVE-2018-13374
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
9.8
CVE-2022-38381
An improper handling of malformed request vulnerability [CWE-228] exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0…
9.1
CVE-2023-25603
A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized…
8.8
CVE-2023-26205
An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an…
8.8
CVE-2022-35849
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0…