PT-2023-29579 · Fortinet · Fortimail

Publicado 2023-11-14 · Atualizado 2023-11-18 · CVE-2023-45582

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions FortiMail webmail versions 7.2.0 through 7.2.4 FortiMail webmail versions 7.0.0 through 7.0.6 FortiMail webmail versions before 6.4.8

Description An improper restriction of excessive authentication attempts may allow an unauthenticated attacker to perform a brute force attack on the affected endpoints via repeated login attempts.

Recommendations For versions 7.2.0 through 7.2.4, consider restricting access to the login endpoint to minimize the risk of exploitation. For versions 7.0.0 through 7.0.6, consider implementing rate limiting on the login attempts to reduce the risk of brute force attacks. For versions before 6.4.8, consider disabling the webmail login functionality until a patch is available. As a temporary workaround, consider monitoring the login attempts and blocking suspicious activity to minimize the risk of exploitation.

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2023-45582

Produtos afetados

Fortimail

Referências · 5

• https://twitter.com/CVEnew/status/1724491738247479503 · Publicação no Twitter
• https://fortiguard.com/psirt/FG-IR-23-287 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-45582 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-45582 · Aviso do Fabricante
• https://t.me/cvenotify/60679 · Publicação no Telegram