PT-2015-6140 · Fortinet · Fortimail

Published 2015-04-14 · Updated 2017-01-03 · CVE-2015-3293

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiMail versions 5.0.3 through 5.2.3

Description The issue allows remote administrators to obtain credentials via the diag debug application httpd command.

Recommendations For FortiMail versions 5.0.3 through 5.2.3, consider restricting access to the diag debug application httpd command until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-3293

Affected Products

Fortimail

References · 3

• http://fortiguard.com/advisory/FG-IR-15-009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3293 · Security Note
• http://securitytracker.com/id/1032185 · Note