Unauthenticated user can determine software-version information
Fortinet PSIRT Advisories
Fortinet PSIRT Contact:
Website: https://fortiguard.fortinet.com/faq/psirt-contact
FG-IR-20-105
Final
1
1
2020-11-03T00:00:00
Current version
2020-11-03T00:00:00
2025-03-28T00:00:00
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiMail may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file.
Information disclosure
FortiMail versions 6.0.9 and below.FortiMail versions 6.2.4 and belowFortiMail versions 6.4.1 and below.FortiDDoS version 5.4.0.FortiDDoS version 5.3.2 and below.FortiDDoS version 5.2.0.FortiDDoS version 5.1.0.FortiDDoS version 5.0.0.FortiDDoS version 4.7.0.FortiDDoS version 4.6.0.FortiDDoS version 4.5.0.FortiDDoS version 4.4.2 and below.FortiDDoS-CM version 5.3.0.FortiDDoS-CM version 5.2.0.FortiDDoS-CM version 5.1.0.FortiDDoS-CM version 5.0.0.FortiDDoS-CM version 4.7.0.FortiVoice version 6.0.6 and below.FortiRecorder version 6.0.3 and below.
Please upgrade to FortiMail versions 6.0.10 or above.Please upgrade to FortiMail versions 6.2.5 or above.Please upgrade to FortiMail versions 6.4.2 or above.Please upgrade to FortiDDoS versions 5.5.0 or above.Please upgrade to FortiDDoS versions 5.4.3 or above.Please upgrade to FortiDDoS-CM versions 5.4.1 or above.Please upgrade to FortiVoice versions 6.4.0 or above.Please upgrade to FortiVoice versions 6.0.7 or above.Please upgrade to FortiRecorder versions 6.0.4 or above.
Fortinet is pleased to thank Patrick Schmid from Redguard for reporting this vulnerability under responsible disclosure.
FortiDDoS 5.4.0
FortiDDoS 5.3.2
FortiDDoS 5.3.1
FortiDDoS 5.3.0
FortiDDoS 5.2.0
FortiDDoS 5.1.0
FortiDDoS 5.0.0
FortiDDoS 4.7.0
FortiDDoS 4.6.0
FortiDDoS 4.5.0
FortiDDoS 4.4.2
FortiDDoS 4.4.1
FortiDDoS 4.4.0
FortiDDoS-CM 5.3.0
FortiDDoS-CM 5.2.0
FortiDDoS-CM 5.1.0
FortiDDoS-CM 5.0.0
FortiDDoS-CM 4.7.0
FortiMail 6.4.1
FortiMail 6.4.0
FortiMail 6.2.4
FortiMail 6.2.3
FortiMail 6.2.2
FortiMail 6.2.1
FortiMail 6.2.0
FortiMail 6.0.9
FortiMail 6.0.8
FortiMail 6.0.7
FortiMail 6.0.6
FortiMail 6.0.5
FortiMail 6.0.4
FortiMail 6.0.3
FortiMail 6.0.2
FortiMail 6.0.1
FortiMail 6.0.0
FortiMail 5.4.12
FortiMail 5.4.11
FortiMail 5.4.10
FortiMail 5.4.9
FortiMail 5.4.8
FortiMail 5.4.7
FortiMail 5.4.6
FortiMail 5.4.5
FortiMail 5.4.4
FortiMail 5.4.3
FortiMail 5.4.2
FortiMail 5.4.1
FortiMail 5.4.0
FortiMail 5.3.13
FortiMail 5.3.12
FortiMail 5.3.10
FortiMail 5.3.9
FortiMail 5.3.8
FortiMail 5.3.7
FortiMail 5.3.6
FortiMail 5.3.5
FortiMail 5.3.4
FortiMail 5.3.3
FortiMail 5.3.2
FortiMail 5.3.1
FortiMail 5.3.0
FortiMail 5.2.10
FortiMail 5.2.9
FortiMail 5.2.8
FortiMail 5.2.7
FortiMail 5.2.6
FortiMail 5.2.5
FortiMail 5.2.4
FortiMail 5.2.3
FortiMail 5.2.2
FortiMail 5.2.1
FortiMail 5.2.0
FortiMail 5.1.7
FortiMail 5.1.6
FortiMail 5.1.5
FortiMail 5.1.4
FortiMail 5.1.3
FortiMail 5.1.2
FortiMail 5.1.1
FortiMail 5.1.0
FortiMail 5.0.11
FortiMail 5.0.10
FortiMail 5.0.9
FortiMail 5.0.8
FortiMail 5.0.7
FortiMail 5.0.6
FortiMail 5.0.5
FortiMail 5.0.4
FortiMail 5.0.3
FortiMail 5.0.2
FortiMail 5.0.1
FortiMail 5.0.0
FortiMail 4.3.9
FortiMail 4.3.8
FortiMail 4.3.7
FortiMail 4.3.6
FortiMail 4.3.5
FortiMail 4.3.4
FortiMail 4.3.3
FortiMail 4.3.2
FortiMail 4.3.1
FortiMail 4.3.0
FortiMail 4.2.4
FortiMail 4.2.3
FortiMail 4.2.2
FortiMail 4.2.1
FortiMail 4.2.0
FortiMail 4.1.3
FortiMail 4.1.2
FortiMail 4.1.1
FortiMail 4.1.0
FortiMail 4.0.5
FortiMail 4.0.4
FortiMail 4.0.3
FortiMail 4.0.1
FortiRecorder 6.0.3
FortiRecorder 6.0.2
FortiRecorder 6.0.1
FortiRecorder 6.0.0
FortiVoice 6.0.6
FortiVoice 6.0.5
FortiVoice 6.0.4
FortiVoice 6.0.3
FortiVoice 6.0.2
FortiVoice 6.0.1
FortiVoice 6.0.0
Unauthenticated user can determine software-version information
CVE-2020-15933
CVE-2021-24008
FortiDDoS-5.4.0
FortiDDoS-5.3.2
FortiDDoS-5.3.1
FortiDDoS-5.3.0
FortiDDoS-5.2.0
FortiDDoS-5.1.0
FortiDDoS-5.0.0
FortiDDoS-4.7.0
FortiDDoS-4.6.0
FortiDDoS-4.5.0
FortiDDoS-4.4.2
FortiDDoS-4.4.1
FortiDDoS-4.4.0
FortiDDoS-CM-5.3.0
FortiDDoS-CM-5.2.0
FortiDDoS-CM-5.1.0
FortiDDoS-CM-5.0.0
FortiDDoS-CM-4.7.0
FortiMail-6.4.1
FortiMail-6.4.0
FortiMail-6.2.4
FortiMail-6.2.3
FortiMail-6.2.2
FortiMail-6.2.1
FortiMail-6.2.0
FortiMail-6.0.9
FortiMail-6.0.8
FortiMail-6.0.7
FortiMail-6.0.6
FortiMail-6.0.5
FortiMail-6.0.4
FortiMail-6.0.3
FortiMail-6.0.2
FortiMail-6.0.1
FortiMail-6.0.0
FortiMail-5.4.12
FortiMail-5.4.11
FortiMail-5.4.10
FortiMail-5.4.9
FortiMail-5.4.8
FortiMail-5.4.7
FortiMail-5.4.6
FortiMail-5.4.5
FortiMail-5.4.4
FortiMail-5.4.3
FortiMail-5.4.2
FortiMail-5.4.1
FortiMail-5.4.0
FortiMail-5.3.13
FortiMail-5.3.12
FortiMail-5.3.10
FortiMail-5.3.9
FortiMail-5.3.8
FortiMail-5.3.7
FortiMail-5.3.6
FortiMail-5.3.5
FortiMail-5.3.4
FortiMail-5.3.3
FortiMail-5.3.2
FortiMail-5.3.1
FortiMail-5.3.0
FortiMail-5.2.10
FortiMail-5.2.9
FortiMail-5.2.8
FortiMail-5.2.7
FortiMail-5.2.6
FortiMail-5.2.5
FortiMail-5.2.4
FortiMail-5.2.3
FortiMail-5.2.2
FortiMail-5.2.1
FortiMail-5.2.0
FortiMail-5.1.7
FortiMail-5.1.6
FortiMail-5.1.5
FortiMail-5.1.4
FortiMail-5.1.3
FortiMail-5.1.2
FortiMail-5.1.1
FortiMail-5.1.0
FortiMail-5.0.11
FortiMail-5.0.10
FortiMail-5.0.9
FortiMail-5.0.8
FortiMail-5.0.7
FortiMail-5.0.6
FortiMail-5.0.5
FortiMail-5.0.4
FortiMail-5.0.3
FortiMail-5.0.2
FortiMail-5.0.1
FortiMail-5.0.0
FortiMail-4.3.9
FortiMail-4.3.8
FortiMail-4.3.7
FortiMail-4.3.6
FortiMail-4.3.5
FortiMail-4.3.4
FortiMail-4.3.3
FortiMail-4.3.2
FortiMail-4.3.1
FortiMail-4.3.0
FortiMail-4.2.4
FortiMail-4.2.3
FortiMail-4.2.2
FortiMail-4.2.1
FortiMail-4.2.0
FortiMail-4.1.3
FortiMail-4.1.2
FortiMail-4.1.1
FortiMail-4.1.0
FortiMail-4.0.5
FortiMail-4.0.4
FortiMail-4.0.3
FortiMail-4.0.1
FortiRecorder-6.0.3
FortiRecorder-6.0.2
FortiRecorder-6.0.1
FortiRecorder-6.0.0
FortiVoice-6.0.6
FortiVoice-6.0.5
FortiVoice-6.0.4
FortiVoice-6.0.3
FortiVoice-6.0.2
FortiVoice-6.0.1
FortiVoice-6.0.0
5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X
https://fortiguard.fortinet.com/psirt/FG-IR-20-105
Unauthenticated user can determine software-version information
Reference>