Improper Input Neutralization in FortiMail by Fortinet

CVE-2023-36637

Summary

FortiMail, developed by Fortinet, exhibits a vulnerability wherein an authenticated attacker can exploit improper input validation during web page generation. This weakness allows the malicious injection of HTML tags into FortiMail's calendar through certain input fields, potentially compromising the integrity and security of user data. It is crucial for users of FortiMail versions 7.2.0, 7.2.1, 7.2.2, and earlier than 7.0.5 to implement necessary security measures to mitigate this risk.

References