CVE-2019-15707 — Improper Input Validation in Fortinet Fortimail

CWE-20 — Improper Input Validation6 documents6 sources
Severity
4.9MEDIUMNVD
EPSS
0.9%
top 24.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet FortimailFortinet Fortimail
Timeline
PublishedJan 23
Latest updateMay 24

Description

An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

▶NVDfortinet/fortimail6.0.0 — 6.0.6+2
▶CVEListV5fortinet/fortinet_fortimailFortiMail 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below

🔴Vulnerability Details

2
GHSA
GHSA-2427-rpxm-q3f4: An improper access control vulnerability in FortiMail admin webUI 6↗2022-05-24
▶
CVEList
CVE-2019-15707: An improper access control vulnerability in FortiMail admin webUI 6↗2020-01-23
▶

📋Vendor Advisories

2
Fortinet
An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow admi...↗2020-01-23
▶
Red Hat
struts2: Crafted JSON request can result in DoS↗2017-12-01
▶

💬Community

1
Bugzilla
CVE-2017-15707 struts2: Crafted JSON request can result in DoS↗2017-12-06
▶
CVE-2019-15707 — Improper Input Validation in Fortinet | cvebase