Lucene search

FortinetCVE-2021-43062

HistoryFeb 02, 2022 - 11:15 a.m.

CVE-2021-43062

2022-02-0211:15:07

CWE-79

fortinet

web.nvd.nist.gov

fortinet fortimail

web security

code execution

http requests

cross-site scripting

fortiguard uri protection service

cve-2021-43062

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.006

Percentile

78.2%

JSON

A improper neutralization of input during web page generation (‘cross-site scripting’) in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.

Affected configurations

Nvd

Node

fortinetfortimailRange6.2.0–6.2.8

fortinetfortimailRange6.4.0–6.4.6

fortinetfortimailRange7.0.0–7.0.2

VendorProductVersionCPE
fortinetfortimail*cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortimail	*	cpe:2.3:a:fortinet:fortimail::::::::

CNA Affected

[
  {
    "product": "Fortinet FortiMail",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiMail 7.0.1, 7.0.0, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0"
      }
    ]
  }
]