PT-2022-1779 · Fortinet · Fortimail

Published 2022-03-01 · Updated 2022-07-12 · CVE-2021-36166

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiMail versions prior to 7.0.1

Description The issue is related to an improper authentication mechanism in the system, which may allow a remote attacker to guess an administrative account's authentication token by observing certain system properties. This could potentially lead to unauthorized access.

Recommendations For FortiMail versions prior to 7.0.1, update to version 7.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to administrative accounts and monitoring system activity for suspicious behavior.

Fix

Improper Authentication

Use of Insufficiently Random Values

Weakness Enumeration

CWE-287

CWE-330

Related Identifiers

BDU:2022-01142

CVE-2021-36166

Affected Products

Fortimail

References · 6

• https://safe-surf.ru/upload/VULN/VULN-20220302.1.pdf · Security Note
• https://fortiguard.com/psirt/FG-IR-21-028 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01142 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36166 · Security Note
• https://t.me/cibsecurity/38268 · Telegram Post