« Volver al listado

CVE-2020-9294

Estado: ModificadaCrítica (9.8)—

An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Fortinet — FortimailFortinet — Fortivoice

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-9294",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "FortiMail",
          "versions": [
            {
              "status": "affected",
              "version": "5.4.10"
            },
            {
              "status": "affected",
              "version": "6.0.7"
            },
            {
              "status": "affected",
              "version": "6.2.2 and earlier"
            }
          ]
        },
        {
          "vendor": "Fortinet",
          "product": "FortiVoiceEnterprise",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.0"
            },
            {
              "status": "affected",
              "version": "6.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-27T17:15:13.593",
  "references": [
    {
      "url": "https://fortiguard.com/psirt/FG-IR-20-045",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/psirt/FG-IR-20-045",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de autenticación inapropiada en FortiMail versiones 5.4.10, 6.0.7, 6.2.2 y anteriores y en FortiVoiceEntreprise versiones 6.0.0 y 6.0.1, puede permitir a un atacante remoto no autenticado acceder al sistema como usuario legítimo al solicitar un cambio de contraseña por medio de la interfaz de usuario."
    }
  ],
  "lastModified": "2026-06-17T03:27:43.067",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A0943A1-AE18-416D-BD0B-C519939E4F24",
              "versionEndIncluding": "5.4.10"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5F9DD6A-23C9-44C2-AF8C-409EDB6ECCD1",
              "versionEndIncluding": "6.0.7",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08C73418-FAB3-477D-85F9-621874FBE8DA",
              "versionEndIncluding": "6.2.2",
              "versionStartIncluding": "6.2.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28A42A3E-FBA6-4A68-AD2B-7CFFBDCF1E49",
              "versionEndIncluding": "6.0.1",
              "versionStartIncluding": "6.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}