| IR Number | FG-IR-22-064 |
| Date | Nov 1, 2022 |
| Severity |
High |
| CVSSv3 Score | 7.4 |
| Impact | Improper access control |
| CVE ID | CVE-2022-26119 |
| Affected Products |
FortiSIEM
:
6.4.2, 6.4.1, 6.4.0, 6.3.3, 6.3.2, 6.3.1, 6.3.0, 6.2.1, 6.2.0, 6.1.2, 6.1.1, 6.1.0, 5.4.0, 5.3.3, 5.3.2, 5.3.1, 5.3.0, 5.2.8, 5.2.7, 5.2.6, 5.2.5, 5.2.2, 5.2.1, 5.1.3, 5.1.2, 5.1.1, 5.1.0, 5.0.1, 5.0.0
|
| CVRF | Download |
Refine Search
PSIRT Advisories
FortiSIEM - Glassfish local credentials stored in plain text
Summary
An improper authentification vulnerability [CWE-287] in FortiSIEM may allow a local attacker with CLI access to perform operations on the Glassfish server directly via a hardcoded password.
Affected Products
At leastFortiSIEM version 6.4.0 through 6.4.1
FortiSIEM version 6.3.0 through 6.3.3
FortiSIEM version 6.2.0 through 6.2.1
FortiSIEM version 6.1.0 through 6.1.2
FortiSIEM version 5.4.0
FortiSIEM version 5.3.0 through 5.3.3
FortiSIEM version 5.2.5 through 5.2.8
FortiSIEM version 5.2.1 through 5.2.2
FortiSIEM version 5.1.0 through 5.1.3
FortiSIEM version 5.0.0 through 5.0.1
Solutions
Please upgrade to FortiSIEM version 6.5.0 or above