Lucene search

FortinetCVE-2020-9294

HistoryApr 27, 2020 - 5:15 p.m.

CVE-2020-9294

2020-04-2717:15:13

CWE-287

fortinet

web.nvd.nist.gov

cve-2020-9294

vulnerability

fortimail

fortivoiceentreprise

authentication

remote access

unauthenticated attacker

password change

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.028

Percentile

90.7%

JSON

An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface.

Affected configurations

Nvd

Node

fortinetfortimailRange≤5.4.10

fortinetfortimailRange6.0.0–6.0.7

fortinetfortimailRange6.2.0–6.2.2

fortinetfortivoiceRange6.0.0–6.0.1

VendorProductVersionCPE
fortinetfortimail*cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*
fortinetfortivoice*cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortimail	*	cpe:2.3:a:fortinet:fortimail::::::::
fortinet	fortivoice	*	cpe:2.3:a:fortinet:fortivoice::::::::

CNA Affected

[
  {
    "product": "FortiMail",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "5.4.10"
      },
      {
        "status": "affected",
        "version": "6.0.7"
      },
      {
        "status": "affected",
        "version": "6.2.2 and earlier"
      }
    ]
  },
  {
    "product": "FortiVoiceEnterprise",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "6.0.0"
      },
      {
        "status": "affected",
        "version": "6.0.1"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-20-045

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.028

Percentile

90.7%

JSON

Related for CVE-2020-9294