CVE-2021-24020

7.5HIGH

Key Information:

Vendor
Fortinet
Status
Fortinet Fortimail
Vendor
CVE Published:
9 July 2021

Summary

A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification.

Affected Version(s)

Fortinet FortiMail FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7

References

https://fortiguard.com/advisory/FG-IR-21-027
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.