Fortinet Fortimail vulnerabilities, page 3
49 vulnerabilities
Known vulnerabilities in Fortinet Fortimail, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2019-15712fortinet · fortimailfortinet fortimailAn improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for.EPSS1.00%MediumCVE-2019-15707fortinet · fortimailfortinet fortimailAn improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for.EPSS1.26%CriticalCVE-2026-104286fortinet · fortimailfortinet fortimailAn improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.KEVEPSS2.20%CriticalCVE-2023-47539fortinet · fortimailfortinet fortimailAn improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may allow a remote unauthenticated attacker to bypass admin login via a crafted HTTP request.EPSS1.06%HighCVE-2023-36556fortinet · fortimailfortinet fortimailAn incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests.EPSS1.09%MediumCVE-2023-36637fortinet · fortimailfortinet fortimailAn improper neutralization of input during web page generation vulnerability [CWE-79] in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to inject HTML tags in FortiMail's calendar via input fields.EPSS0.51%MediumCVE-2023-36633fortinet · fortimailfortinet fortimailAn improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPs requests.EPSS0.47%HighCVE-2023-45582fortinet · fortimailfortinet fortimailAn improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to perform a brute force attack on the affected endpoints via repeated login attempts.EPSS0.52%HighCVE-2023-33302fortinet · fortimail +1 morefortinet fortimailA buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4 and before 6.2.6 and FortiNDR administrative interface version 7.2.0 and before 7.1.0 allows an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.EPSS0.37%