PT-2021-3593 · Fortinet · Fortimail

Published 2021-06-21 · Updated 2021-07-13 · CVE-2021-24013

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiMail versions prior to 6.4.4

Description The issue is related to path traversal vulnerabilities in the Webmail system of FortiMail, which can be exploited by a remote attacker using specially crafted web requests to gain unauthorized access to protected information and files.

Recommendations For versions prior to 6.4.4, update to version 6.4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Webmail system until the update can be applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2021-03697

CVE-2021-24013

Affected Products

Fortimail

References · 6

• https://bdu.fstec.ru/vul/2021-03697 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-24013 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24013 · Vendor Advisory
• https://fortiguard.com/advisory/FG-IR-21-014 · Vendor Advisory
• https://t.me/cvenotify/17459 · Telegram Post
• https://fortiguard.com/psirt/FG-IR-21-014 · Note