✕
Request a Demo
Rewterz
Rewterz Threat Advisory – CVE-2021-1234 – Cisco SD-WAN vManage Software Information Disclosure Vulnerability
July 8, 2021
Rewterz
Rewterz Threat Alert – Donot APT Group – IOCs
July 8, 2021

Rewterz Threat Advisory – Multiple Vulnerabilities in FortiMail

Severity

High

Analysis Summary

CVE-2021-24015

An improper neutralization of special elements used in an OS Command vulnerability in FortiMail’s administrative interface may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.

CVE-2021-22129

Multiple instances of incorrect calculation of buffer size in FortiMail Webmail and Administrative interface may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.

CVE-2021-26090

A missing release of memory after its effective lifetime vulnerability in FortiMail Webmail may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests.

Impact

  • Code Execution
  • Unauthorized Access

Affected Vendors

Fortinet

Affected Products

  • FortiMail 6.4.3
  • FortiMail 6.2.6
  • FortiMail 6.0.10
  • FortiMail 5.4.12
  • FortiMail 6.4.4 and below
  • FortiMail 6.2.6 and below
  • FortiMail 6.0.10 and below
  • FortiMail 5.4.12 and below

Remediation

Refer to Fortinet Advisory for patch upgrade, or suggested workaround information

https://www.fortiguard.com/psirt/FG-IR-21-021