PT-2023-25622 · Fortinet · Fortimail

Publicado 2023-10-10 · Atualizado 2023-10-13 · CVE-2023-36556

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiMail webmail versions 6.4.6 and earlier FortiMail webmail versions 7.0.0 through 7.0.5 FortiMail webmail versions 7.2.0 through 7.2.2

Description An incorrect authorization issue allows an authenticated attacker to login to other users' accounts from the same web domain via crafted HTTP or HTTPS requests.

Recommendations For FortiMail webmail versions 6.4.6 and earlier, update to a version above 6.4.6 to resolve the issue. For FortiMail webmail versions 7.0.0 through 7.0.5, update to a version above 7.0.5 to resolve the issue. For FortiMail webmail versions 7.2.0 through 7.2.2, update to a version above 7.2.2 to resolve the issue.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-36556

Produtos afetados

Fortimail

Referências · 4

• https://t.me/cibsecurity/71968 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-36556 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-36556 · Nota de Segurança
• https://fortiguard.com/psirt/FG-IR-23-202 · Aviso do Fabricante