Authentication flaw

2023-03-0915:15:00

PRIOn knowledge base

www.prio-n.com

vulnerability

cwe-307

fortinet fortimail

cpu exhaustion

memory exhaustion

http requests

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.9%

JSON

A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before 6.0.9 allows a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form.

CPENameOperatorVersion
fortimaileq6.4.0
fortimailge6.2.1
fortimaillt6.2.5
fortimailge6.0.0
fortimaillt6.0.10

Name	Operator	Version
fortimail	eq	6.4.0
fortimail	ge	6.2.1
fortimail	lt	6.2.5
fortimail	ge	6.0.0
fortimail	lt	6.0.10

References

fortiguard.com/psirt/FG-IR-20-078