Lucene search

FortinetCVELIST:CVE-2021-24020

HistoryJul 09, 2021 - 6:17 p.m.

CVE-2021-24020

2021-07-0918:17:26

fortinet

www.cve.org

cryptographic step

fortimail

hash digest algorithm

signature verification

cve-2021-24020

unauthenticated attacker

tampering

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.003

Percentile

70.0%

JSON

A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification.

CNA Affected

[
  {
    "product": "Fortinet FortiMail",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7"
      }
    ]
  }
]

References

fortiguard.com/advisory/FG-IR-21-027

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.003

Percentile

70.0%

JSON

Related for CVELIST:CVE-2021-24020