CVE-2022-39945 — Authorization Bypass Through User-Controlled Key in Fortinet Fortimail
Severity
6.5MEDIUMNVD
CNA5.4
EPSS
0.2%
top 59.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 2
Description
An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references (IDOR).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitability: 1.2 | Impact: 5.2
Affected Packages2 packages
▶CVEListV5fortinet/fortinet_fortimailFortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions
🔴Vulnerability Details
2📋Vendor Advisories
1Fortinet▶
An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all ve...↗2022-11-02