CVE-2022-39945

2022-11-0212:15:54

CWE-639

[email protected]

web.nvd.nist.gov

access control vulnerability

fortimail

admin user

domain

insecure direct object references

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

28.4%

JSON

An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references (IDOR).

Affected configurations

Nvd

Node

fortinetfortimailRange6.0.0–6.0.12

fortinetfortimailRange6.2.0–6.2.9

fortinetfortimailRange6.4.0–6.4.7

fortinetfortimailRange7.0.0–7.0.3

fortinetfortimailMatch7.2.0

VendorProductVersionCPE
fortinetfortimail*cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*
fortinetfortimail7.2.0cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*