PT-2023-6015 · Fortinet · Fortimail

Published 2023-10-10 · Updated 2023-10-13 · CVE-2023-36637

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions FortiMail versions 7.0.0 through 7.0.4 FortiMail versions 7.2.0 through 7.2.2

Description The issue is related to the improper neutralization of input during web page generation, which can be exploited by a remote attacker to execute arbitrary code. An authenticated attacker can inject HTML tags in FortiMail's calendar via input fields.

Recommendations For FortiMail versions 7.0.0 through 7.0.4, update to version 7.0.5 or later. For FortiMail versions 7.2.0 through 7.2.2, update to a version later than 7.2.2. As a temporary workaround, consider restricting access to the calendar feature in FortiMail to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-06716

CVE-2023-36637

Affected Products

Fortimail

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-36637 · Security Note
• https://fortiguard.com/psirt/FG-IR-23-194 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06716 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36637 · Vendor Advisory