CVE-2015-1453

Published Feb 2, 2015

Last updated 3 months ago

Overview

Description: The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 5
Impact score: 2.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:N/A:N

Weaknesses

nvd@nist.gov: CWE-310

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:android:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DE684F34-7333-409D-AF62-B8AAD3E2499E",
            "versionEndIncluding": "5.2.3.091"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References