CVE-2022-39945

published 2022-11-02

CVE-2022-39945: An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an…

Priority P3 35 medium 6.5 CVSS 3.1

AV N AC L PR H UI N S U C H I H A N

An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references (IDOR).

Affected

7 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortimail	—	—
fortinet	fortimail	—	—
fortinet	fortimail	6.0.0 – 6.0.12	—
fortinet	fortimail	6.2.0 – 6.2.9	—
fortinet	fortimail	6.4.0 – 6.4.7	—
fortinet	fortimail	7.0.0 – 7.0.3	—
fortinet	fortinet_fortimail	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-639