PT-2021-3662 · Fortinet · Fortimail

Published 2021-06-16 · Updated 2023-08-08 · CVE-2021-26095

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiMail versions 6.2.0 through 6.2.6 FortiMail versions 6.4.0 through 6.4.4

Description The issue is related to cryptographic problems in the session management of FortiMail, including the encryption construction of the session cookie. This may allow a remote attacker who already has a cookie to reveal, alter, or forge its content, potentially escalating privileges.

Recommendations For FortiMail versions 6.2.0 through 6.2.6, update to a version outside of this range to resolve the issue. For FortiMail versions 6.4.0 through 6.4.4, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to session management functions until a patch is available.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

BDU:2021-03895

CVE-2021-26095

Affected Products

Fortimail

References · 7

• https://fortiguard.com/advisory/FG-IR-21-019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26095 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26095 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03895 · Security Note
• https://t.me/cibsecurity/26277 · Telegram Post
• https://fortiguard.com/psirt/FG-IR-21-019 · Note
• https://cybersecurity-help.cz/vdb/SB2021071352 · Note