Fortinet Fortimail vulnerabilities

CVE-2022-39945 [MEDIUM] CWE-639 CVE-2022-39945: An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references (IDOR).

CVE-2022-26114 [MEDIUM] CWE-79 CVE-2022-26114: An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting (XSS) attack via sending specially crafted mail messages.

CVE-2021-32586 [HIGH] CWE-20 CVE-2021-32586: An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0. An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the environment of the underlying script interpreter via specifically crafted HTTP requests.

CVE-2021-36166 [CRITICAL] CWE-330 CVE-2021-36166: An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to ef An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties.

CVE-2021-43062 [MEDIUM] CWE-79 CVE-2021-43062: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet F A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.

CVE-2020-15933 [MEDIUM] CWE-200 CVE-2020-15933: A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 an A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versions 6.4.1 and 6.4.0 allows attacker to obtain potentially sensitive software-version information via client-side resources inspection.

CVE-2021-26095 [HIGH] CVE-2021-26095: The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges.

CVE-2021-24015 [HIGH] CWE-78 CVE-2021-24015: An improper neutralization of special elements used in an OS Command vulnerability in the administra An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.

CVE-2021-26090 [MEDIUM] CWE-401 CVE-2021-26090: A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6 A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests.

CVE-2021-26099 [MEDIUM] CVE-2021-26099: Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may a Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted master keys to compromise their confidentiality by observing a few invariant properties of the ciphertext.

CVE-2021-24013 [HIGH] CWE-22 CVE-2021-24013: Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests.

CVE-2021-24007 [CRITICAL] CWE-89 CVE-2021-24007: Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail be Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

CVE-2021-24020 [HIGH] CWE-347 CVE-2021-24020: A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 t A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification.

CVE-2021-26100 [MEDIUM] CWE-347 CVE-2021-26100: A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such a way that makes the tampering and the recovery of the plaintexts possible.

CVE-2021-22129 [HIGH] CWE-120 CVE-2021-22129: Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interfa Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.