Improper Authentication Vulnerability in FortiMail and FortiVoice by Fortinet

CVE-2020-9294

Summary

An improper authentication vulnerability exists in FortiMail versions 5.4.10, 6.0.7, and 6.2.2, as well as in FortiVoice versions 6.0.0 and 6.0.1. This flaw may permit a remote attacker, who does not have valid credentials, to gain unauthorized access to the system. By exploiting this vulnerability, an attacker can initiate a password change request through the user interface, effectively impersonating a legitimate user and potentially compromising sensitive information or system integrity.

References