PT-2021-3964 · Fortinet · Fortimail

Published 2021-06-16 · Updated 2021-07-13 · CVE-2021-26090

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FortiMail versions 6.2.0 through 6.2.6 FortiMail versions 6.4.0 through 6.4.4

Description A missing release of memory after its effective lifetime issue in the Webmail component of FortiMail may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests, potentially leading to a denial of service.

Recommendations For FortiMail versions 6.2.0 through 6.2.6, update to a version that fixes the memory release issue to prevent exploitation. For FortiMail versions 6.4.0 through 6.4.4, update to a version that fixes the memory release issue to prevent exploitation. As a temporary workaround, consider restricting access to the Webmail login functionality to minimize the risk of exploitation.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2021-04483

CVE-2021-26090

Affected Products

Fortimail

References · 7

• https://bdu.fstec.ru/vul/2021-04483 · Security Note
• https://fortiguard.com/advisory/FG-IR-21-042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26090 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26090 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-21-042 · Note
• https://t.me/cvenotify/17447 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021071352 · Note