Improper Access Control in FortiMail by Fortinet

CVE-2022-39945

Summary

An improper access control vulnerability has been identified in FortiMail, which allows authenticated admin users assigned to a specific domain to gain unauthorized access to the information of other domains. This vulnerability may be exploited through insecure direct object references (IDOR), provided that the attacker has valid admin credentials, giving them the ability to modify sensitive domain information unlawfully. It's crucial for organizations utilizing affected FortiMail versions to apply necessary patches and limit the administrative privileges appropriately to safeguard against potential exploitation.

References