Vulnerability · Published Jul 20, 2021 · Assigned by fortinet
CVE-2021-26095
High 7.5
In plain English
A high-severity security flaw in Fortinet FortiMail from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 47.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortinet FortiMail | FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 |
References
- https://fortiguard.com/advisory/FG-IR-21-019 x_refsource_CONFIRM