| IR Number | FG-IR-21-012 |
| Date | Jul 7, 2021 |
| Severity |
Critical |
| CVSSv3 Score | 9.3 |
| Impact | Execute unauthorized code or commands |
| CVE ID | CVE-2021-24007 |
| Affected Products |
FortiMail
:
6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.10, 6.0.1, 6.0.0, 5.4.9, 5.4.8, 5.4.7, 5.4.6, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.12, 5.4.11, 5.4.10, 5.4.1, 5.4.0, 5.3.9, 5.3.8, 5.3.7, 5.3.6, 5.3.5, 5.3.4, 5.3.3, 5.3.2, 5.3.13, 5.3.12, 5.3.10, 5.3.1, 5.3.0, 5.2.9, 5.2.8, 5.2.7, 5.2.6, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.10, 5.2.1, 5.2.0, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.3, 5.1.2, 5.1.1, 5.1.0, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.11, 5.0.10, 5.0.1, 5.0.0
|
| CVRF | Download |
Refine Search
PSIRT Advisories
FortiMail - SQL Injection vulnerabilities
Summary
Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Affected Products
FortiMail version 6.4.4 and below.
FortiMail version 6.2.6 and below.
FortiMail version 6.0.10 an below.
FortiMail version 5.4.12 and below.
Solutions
Upgrade to version 7.0.0 or higher.
Upgrade to version 6.4.5 or higher.
Upgrade to version 6.2.7 or higher.
Upgrade to version 6.0.11 or higher.
5.4 Fix to be confirmed.