CVE-2019-17655: 
FortiOS vulnerability analysis and mitigation

A cleartext storage vulnerability (CVE-2019-17655) was identified in FortiOS SSL VPN versions 6.2.0 through 6.2.2, 6.0.9 and earlier, as well as FortiProxy versions 2.0.0, 1.2.9 and earlier. The vulnerability was disclosed in June 2020 and involves the insecure storage of sensitive information in cleartext format (NVD).

The vulnerability is classified as a cleartext storage of sensitive information (CWE-312) issue. It allows potential attackers to retrieve logged-in SSL VPN user credentials by accessing session files stored on the targeted device's system. The vulnerability has received varying CVSS scores, with NVD assigning a CVSS 3.1 base score of 7.5 (High) and Fortinet assigning a score of 5.3 (Medium) (NVD).

If exploited, this vulnerability could lead to the exposure of SSL VPN user credentials, potentially compromising the security of VPN sessions and allowing unauthorized access to protected resources (NVD).

The vulnerability requires the attacker to have access to the session file stored on the targeted device's system. The attack vector is network-based (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N) (NVD).

Fortinet has addressed this vulnerability through security advisories FG-IR-19-217 and FG-IR-20-224. Users are advised to upgrade to the latest versions of FortiOS and FortiProxy that contain the necessary security fixes (Fortinet Advisory, Fortinet Update).