CVE-2023-36556
Fortinet FortiMail
HIGH 8.6
At a glance
- Source
- NVD
- EPSS
- EPSS 1.09 % · percentile 65 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- fortinet
- NVD status
- Modified
Description
An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests.
Weaknesses (CWE)
- CWE-863 — Incorrect Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C | fortinet |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · psirt@fortinet.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-40503
- GCVE · GCVE-0-2023-36556
Affected configurations (NVD CPE)
cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*≥ 6.0.0 ≤ 6.0.12cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*≥ 6.2.0 ≤ 6.2.9cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*≥ 6.4.0 ≤ 6.4.7cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*≥ 7.0.0 ≤ 7.0.5cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Fortinet · FortiMail | affected 7.2.0 ≤ 7.2.2 ; affected 7.0.0 ≤ 7.0.5 ; affected 6.4.0 ≤ 6.4.7 ; affected 6.2.0 ≤ 6.2.9 ; affected 6.0.0 ≤ 6.0.12 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |