Fortinet Fortimail vulnerabilities

46 known vulnerabilities affecting fortinet/fortimail.

Total CVEs

46

CISA KEV

1

actively exploited

Public exploits

3

Exploited in wild

0

Severity breakdown

CRITICAL7HIGH14MEDIUM25

Vulnerabilities

Page 3 of 3

CVE-2019-15707MEDIUMCVSS 4.9≤ 5.4.10≥ 6.0.0, ≤ 6.0.6+1 more2020-01-23

CVE-2019-15707 [MEDIUM] CVE-2019-15707: An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for.

CVE-2017-7732MEDIUMCVSS 6.1v4.1.0v4.2.0+34 more2017-10-26

CVE-2017-7732 [MEDIUM] CWE-79 CVE-2017-7732: A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 th A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests.

CVE-2017-3125MEDIUMCVSS 6.1v5.0v5.0.5+30 more2017-04-12

CVE-2017-3125 [MEDIUM] CWE-79 CVE-2017-3125: An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0 - 5.3.8 could allow an a An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0 - 5.3.8 could allow an attacker to execute arbitrary scripts in the security context of the browser of a victim logged in FortiMail, assuming the victim is social engineered into clicking an URL crafted by the attacker.

CVE-2015-3293MEDIUMCVSS 4.0v5.0.3v5.0.4+12 more2015-04-14

CVE-2015-3293 [MEDIUM] CWE-200 CVE-2015-3293: FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command.

CVE-2014-8617MEDIUMCVSS 4.3≤ 4.3.8v5.0+15 more2015-03-04

CVE-2014-8617 [MEDIUM] CWE-79 CVE-2014-8617: Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI in Fortinet FortiMail before 4.3.9, 5.0.x before 5.0.8, 5.1.x before 5.1.5, and 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via the release parameter to module/releasecontrol.

CVE-2013-1471MEDIUMCVSS 4.3PoC≤ 4.0v3.0+1 more2013-02-04

CVE-2013-1471 [MEDIUM] CWE-79 CVE-2013-1471: Multiple cross-site scripting (XSS) vulnerabilities in admin/FEAdmin.html in Fortinet FortiMail befo Multiple cross-site scripting (XSS) vulnerabilities in admin/FEAdmin.html in Fortinet FortiMail before 4.3.4 on FortiMail Identity-Based Encryption (IBE) appliances allow user-assisted remote attackers to inject arbitrary web script or HTML via (1) the Add field for the Black List under Antispam Management User Preferences or (2) the User name field fo

← Previous3 / 3