PT-2022-1786 · Fortinet · Fortimail
Published
2022-02-01
·
Updated
2022-03-04
·
CVE-2021-43062
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Fortinet FortiMail versions 7.0.1 through 7.0.0
Fortinet FortiMail versions 6.4.5 and below
Fortinet FortiMail versions 6.3.7 and below
Fortinet FortiMail versions 6.0.11 and below
Description
The issue is related to an improper neutralization of input during web page generation, also known as cross-site scripting. This allows an attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service. The attacker can perform an XSS attack, potentially allowing them to execute arbitrary code.
Recommendations
For Fortinet FortiMail versions 7.0.1 and 7.0.0, consider disabling access to the FortiGuard URI protection service until a patch is available.
For Fortinet FortiMail versions 6.4.5 and below, restrict access to the FortiGuard URI protection service to minimize the risk of exploitation.
For Fortinet FortiMail versions 6.3.7 and below, avoid using crafted HTTP GET requests to the FortiGuard URI protection service until the issue is resolved.
For Fortinet FortiMail versions 6.0.11 and below, consider implementing additional security measures to protect against cross-site scripting attacks.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fortimail