PT-2023-25645 · Fortinet · Fortimail

Publicado 2023-11-14 · Atualizado 2023-11-20 · CVE-2023-36633

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiMail webmail versions 7.2.0 through 7.2.2 FortiMail webmail versions prior to 7.0.5

Description The issue allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPS requests. This is due to an improper authorization vulnerability.

Recommendations For FortiMail webmail versions 7.2.0 through 7.2.2, update to a version outside of this range to resolve the issue. For FortiMail webmail versions prior to 7.0.5, update to version 7.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the address book folders to minimize the risk of exploitation.

Correção

Incorrect Permission

Improper Authorization

Enumeração de Fraquezas

CWE-732

CWE-285

Identificadores relacionados

CVE-2023-36633

Produtos afetados

Fortimail

Referências · 4

• https://twitter.com/CVEnew/status/1724491730932617339 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-36633 · Aviso do Fabricante
• https://fortiguard.com/psirt/FG-IR-23-203 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-36633 · Nota de Segurança