Vulnerabilities > CVE-2024-21754 - Use of Password Hash With Insufficient Computational Effort vulnerability in Fortinet Fortios and Fortiproxy

CVSS 4.4 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

local

low complexity

fortinet

CWE-916

NVD

Published: 2024-06-11

Updated: 2024-10-04

Summary

A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file.

Vulnerable Configurations

Part	Description	Count
Application	Fortinet Fortinet Fortiproxy 7.4.0 Fortinet Fortiproxy 7.4.1 Fortinet Fortiproxy 2.0.0 Fortinet Fortiproxy 2.0.1 Fortinet Fortiproxy 2.0.2 Fortinet Fortiproxy 2.0.3 Fortinet Fortiproxy 2.0.4 Fortinet Fortiproxy 2.0.5 Fortinet Fortiproxy 2.0.6 Fortinet Fortiproxy 2.0.7 Fortinet Fortiproxy 2.0.8 Fortinet Fortiproxy 2.0.9 Fortinet Fortiproxy 2.0.10 Fortinet Fortiproxy 2.0.12 Fortinet Fortiproxy 7.2.0 Fortinet Fortiproxy 7.2.1 Fortinet Fortiproxy 7.2.2 Fortinet Fortiproxy 7.2.3 Fortinet Fortiproxy 7.2.4 Fortinet Fortiproxy 7.2.5 Fortinet Fortiproxy 7.2.8 Fortinet Fortiproxy 7.2.9 Fortinet Fortiproxy 7.0.0 Fortinet Fortiproxy 7.0.1 Fortinet Fortiproxy 7.0.2 Fortinet Fortiproxy 7.0.3 Fortinet Fortiproxy 7.0.4 Fortinet Fortiproxy 7.0.5 Fortinet Fortiproxy 7.0.6 Fortinet Fortiproxy 7.0.7 Fortinet Fortiproxy 7.0.8 Fortinet Fortiproxy 7.0.9 Fortinet Fortiproxy 7.0.10 Fortinet Fortiproxy 7.0.11 Fortinet Fortiproxy 7.0.14 Fortinet Fortiproxy 7.0.15	36
OS	Fortinet Fortinet Fortios 6.4.0 Fortinet Fortios 6.4.1 Fortinet Fortios 6.4.2 Fortinet Fortios 6.4.3 Fortinet Fortios 6.4.4 Fortinet Fortios 6.4.5 Fortinet Fortios 6.4.6 Fortinet Fortios 6.4.7 Fortinet Fortios 6.4.8 Fortinet Fortios 6.4.9 Fortinet Fortios 6.4.10 Fortinet Fortios 6.4.11 Fortinet Fortios 6.4.12 Fortinet Fortios 6.4.13 Fortinet Fortios 6.4.14 Fortinet Fortios 6.4.15 Fortinet Fortios 7.4.0 Fortinet Fortios 7.4.1 Fortinet Fortios 7.4.2 Fortinet Fortios 7.4.3 Fortinet Fortios 7.2.0 Fortinet Fortios 7.2.1 Fortinet Fortios 7.2.2 Fortinet Fortios 7.2.3 Fortinet Fortios 7.2.4 Fortinet Fortios 7.2.5 Fortinet Fortios 7.2.6 Fortinet Fortios 7.2.7 Fortinet Fortios 7.2.8 Fortinet Fortios 7.0.0 Fortinet Fortios 7.0.1 Fortinet Fortios 7.0.2 Fortinet Fortios 7.0.3 Fortinet Fortios 7.0.4 Fortinet Fortios 7.0.5 Fortinet Fortios 7.0.6 Fortinet Fortios 7.0.7 Fortinet Fortios 7.0.8 Fortinet Fortios 7.0.9 Fortinet Fortios 7.0.10 Fortinet Fortios 7.0.11 Fortinet Fortios 7.0.12 Fortinet Fortios 7.0.13 Fortinet Fortios 7.0.14	44

Common Weakness Enumeration (CWE)

CWE-916 - Use of Password Hash With Insufficient Computational Effort

References

https://fortiguard.fortinet.com/psirt/FG-IR-23-423