Vulnerability CVE-2021-24020


Published: 2021-07-09

Description:
A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification.

Type:

CWE-326

(Inadequate Encryption Strength)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Fortinet -> Fortimail 

 References:
https://fortiguard.com/advisory/FG-IR-21-027

Copyright 2021, cxsecurity.com

 

Back to Top