CVE-2020-9294: fortinet fortimail Improper Authentication
Vulnerability summary
CVE-2020-9294 is a critical (CVSS 9.8) Improper Authentication vulnerability in fortinet fortimail. EPSS estimates a 77.78% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 27-04-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
77.78%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 77.78% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundFortiMail Unauthenticated Login Bypass Scanner
auxiliary/scanner/http/fortimail_login_bypass_detection
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Fortinet3 products
- fortimail5.4.10 | 6.0.7 | 6.2.2 and earlier | ≤ 5.4.10 | ≥ 6.0.0, ≤ 6.0.7 | ≥ 6.2.0, ≤ 6.2.2
- fortivoice≥ 6.0.0, ≤ 6.0.1
- fortivoiceenterprise6.0.0 | 6.0.1
1 vendor · 3 products