CVE-2023-36556CWE-863

An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an…

High · published October 10, 2023

CVSS v3.1
8.6
EPSS
1%
Percentile
65.1
In the wild
Unconfirmed
What it is

An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C
CVSS v4.0
Not supplied
EPSS
0.01092 · 65.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-10-10T16:49Z
EPSS history
Timeline
  • 10 OCT 16:49Z
    An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an…
    cvelistv5