PT-2022-25140 · Fortinet · Fortimail

Published 2022-11-02 · Updated 2022-11-03 · CVE-2022-39945

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FortiMail versions 6.0 through 7.2.0

Description The issue allows an authenticated admin user assigned to a specific domain to access and modify other domains' information via insecure direct object references (IDOR). This is due to an improper access control vulnerability.

Recommendations For FortiMail versions 6.0 through 7.2.0, consider restricting access to sensitive domain information to prevent unauthorized modifications until a patch is available. As a temporary workaround, limit the privileges of admin users to their assigned domains to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-39945

Affected Products

Fortimail

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-39945 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-066 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39945 · Vendor Advisory