PT-2023-25645 · Fortinet · Fortimail

Published 2023-11-14 · Updated 2023-11-20 · CVE-2023-36633

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiMail webmail versions 7.2.0 through 7.2.2 FortiMail webmail versions prior to 7.0.5

Description The issue allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPS requests. This is due to an improper authorization vulnerability.

Recommendations For FortiMail webmail versions 7.2.0 through 7.2.2, update to a version outside of this range to resolve the issue. For FortiMail webmail versions prior to 7.0.5, update to version 7.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the address book folders to minimize the risk of exploitation.

Fix

Incorrect Permission

Improper Authorization

Weakness Enumeration

CWE-732

CWE-285

Related Identifiers

CVE-2023-36633

Affected Products

Fortimail

References · 4

• https://osv.dev/vulnerability/CVE-2023-36633 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-23-203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36633 · Security Note
• https://twitter.com/CVEnew/status/1724491730932617339 · Twitter Post