SQL Injection vulnerabilities in FortiMail Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-21-012 Final 1 1 2021-07-07T00:00:00 Current version 2021-07-07T00:00:00 2021-07-07T00:00:00 Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Execute unauthorized code or commands FortiMail version 6.4.3 and below.FortiMail version 6.2.6 and below.FortiMail version 6.0.10 an below.FortiMail version 5.4.12 and below. Upgrade to version 6.4.4 or higher.Upgrade to version 6.2.7 or higher.Upgrade to version 6.0.11 or higher.5.4 Fix to be confirmed. Internally discovered and reported by Giuseppe Cocomazzi of the Fortinet PSIRT Team. CVE-2021-24007 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X https://fortiguard.fortinet.com/psirt/FG-IR-21-012 SQL Injection vulnerabilities in FortiMail Reference>