| IR Number | FG-IR-21-028 |
| Date | Mar 1, 2022 |
| Severity |
Critical |
| CVSSv3 Score | 9.3 |
| CVE ID | CVE-2021-36166 |
| Affected Products |
FortiMail
:
7.0.0, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.11, 6.0.10, 6.0.1, 6.0.0, 5.4.9, 5.4.8, 5.4.7, 5.4.6, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.12, 5.4.11, 5.4.10, 5.4.1, 5.4.0
|
| CVRF | Download |
Refine Search
PSIRT Advisories
FortiMail - Administrative authentication bypass
Summary
An improper authentication vulnerability [CWE-287] in FortiMail may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties.
Affected Products
FortiMail version 7.0.0 and below.
FortiMail version 6.4.5 and below.
FortiMail version 6.2.7 and below.
FortiMail version 6.0.11 and below.
FortiMail version 5.4.12 and below.
Solutions
Upgrade to FortiMail version 7.0.1.
Upgrade to FortiMail version 6.4.6.
Upgrade to FortiMail version 6.2.8.
Upgrade to FortiMail version 6.0.12.