CVE-2024-31493 - Vulnerability Details - OpenCVE

An improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7.0.3 and below may allow an authenticated low privileged user to read Connector passwords in plain-text via HTTP responses.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Fortinet	Fortisoar

Configuration 1 [-]

cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://fortiguard.fortinet.com/psirt/FG-IR-24-052

History

Tue, 21 Jan 2025 22:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fortinet Fortinet fortisoar
CPEs		cpe:2.3:a:fortinet:fortisoar::::::::
Vendors & Products		Fortinet Fortinet fortisoar

MITRE

Status: PUBLISHED

Assigner: fortinet

Published: 2024-06-03T07:55:29.476Z

Updated: 2024-08-02T01:52:57.311Z

Reserved: 2024-04-04T12:52:41.586Z

Link: CVE-2024-31493

Vulnrichment

Updated: 2024-06-03T14:11:18.534Z

NVD

Status : Analyzed

Published: 2024-06-03T08:15:09.097

Modified: 2025-01-21T21:49:55.390

Link: CVE-2024-31493

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31493", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2024-04-04T12:52:41.586Z", "datePublished": "2024-06-03T07:55:29.476Z", "dateUpdated": "2024-08-02T01:52:57.311Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiSOAR", "defaultStatus": "unaffected", "versions": [{"version": "7.3.0", "status": "affected"}, {"versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.2", "status": "affected"}, {"versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.3", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7.0.3 and below may allow an authenticated low privileged user to read Connector passwords in plain-text via HTTP responses."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-06-03T07:55:29.476Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-212", "description": "Information disclosure", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:X/RC:X"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiSOAR version 7.3.1 or above \n"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-052", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-052"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-31493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-03T14:10:28.453232Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:36:40.737Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:52:57.311Z"}, "title": "CVE Program Container", "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-052", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-052", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31493", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2024-04-04T12:52:41.586Z", "datePublished": "2024-06-03T07:55:29.476Z", "dateUpdated": "2024-06-04T17:36:40.737Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiSOAR", "defaultStatus": "unaffected", "versions": [{"version": "7.3.0", "status": "affected"}, {"versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.2", "status": "affected"}, {"versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.3", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7.0.3 and below may allow an authenticated low privileged user to read Connector passwords in plain-text via HTTP responses."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-06-03T07:55:29.476Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-212", "description": "Information disclosure", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:X/RC:X"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiSOAR version 7.3.1 or above \n"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-052", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-052"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-31493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-03T14:10:28.453232Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-03T14:11:18.534Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6231C3C-7555-42EA-9AE1-46D63698493D", "versionEndExcluding": "7.3.1", "versionStartIncluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7.0.3 and below may allow an authenticated low privileged user to read Connector passwords in plain-text via HTTP responses."}, {"lang": "es", "value": "Una eliminaci\u00f3n inadecuada de informaci\u00f3n confidencial antes de la vulnerabilidad de almacenamiento o transferencia [CWE-212] en FortiSOAR versi\u00f3n 7.3.0, versi\u00f3n 7.2.2 e inferiores, versi\u00f3n 7.0.3 e inferiores puede permitir que un usuario autenticado con privilegios bajos lea las contrase\u00f1as del conector en formato texto plano a trav\u00e9s de respuestas HTTP."}], "id": "CVE-2024-31493", "lastModified": "2025-01-21T21:49:55.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@fortinet.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-06-03T08:15:09.097", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-052"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-052"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-212"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}