PT-2023-25622 · Fortinet · Fortimail

Published 2023-10-10 · Updated 2023-10-13 · CVE-2023-36556

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiMail webmail versions 6.4.6 and earlier FortiMail webmail versions 7.0.0 through 7.0.5 FortiMail webmail versions 7.2.0 through 7.2.2

Description An incorrect authorization issue allows an authenticated attacker to login to other users' accounts from the same web domain via crafted HTTP or HTTPS requests.

Recommendations For FortiMail webmail versions 6.4.6 and earlier, update to a version above 6.4.6 to resolve the issue. For FortiMail webmail versions 7.0.0 through 7.0.5, update to a version above 7.0.5 to resolve the issue. For FortiMail webmail versions 7.2.0 through 7.2.2, update to a version above 7.2.2 to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-36556

Affected Products

Fortimail

References · 4

• https://osv.dev/vulnerability/CVE-2023-36556 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36556 · Security Note
• https://fortiguard.com/psirt/FG-IR-23-202 · Vendor Advisory
• https://t.me/cibsecurity/71968 · Telegram Post