An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet’s FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15942
Reference (s):
- https://www.fortiguard.com/psirt/FG-IR-20-076
- https://fortiguard.com/advisory/FG-IR-20-076
- URL: https://fortiguard.com/advisory/FG-IR-20-076