« Volver al listado

CVE-2023-36556

Estado: ModificadaAlta (8.8)—

An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fortinet — Fortimail

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-36556",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-36556",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-22T20:57:32.689334Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "FortiMail",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.2"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.5"
            },
            {
              "status": "affected",
              "version": "6.4.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.7"
            },
            {
              "status": "affected",
              "version": "6.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.9"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.12"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-10-10T17:15:12.140",
  "references": [
    {
      "url": "https://fortiguard.com/psirt/FG-IR-23-202",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/psirt/FG-IR-23-202",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@fortinet.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de autorización incorrecta [CWE-863] en el correo web FortiMail versión 7.2.0 a 7.2.2, versión 7.0.0 a 7.0.5 e inferior a 6.4.7 permite a un atacante autenticado iniciar sesión en cuentas de otros usuarios desde el mismo dominio web a través de solicitudes HTTP o HTTPs manipuladas."
    }
  ],
  "lastModified": "2026-06-17T06:06:31.610",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01F784BF-4F89-4938-9150-F911E3EB6CD0",
              "versionEndIncluding": "6.0.12",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AEDC7EE8-084C-4F9E-A510-E283FCDF9832",
              "versionEndIncluding": "6.2.9",
              "versionStartIncluding": "6.2.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D25AB0A-3B0C-40B5-8D7D-78DA7567F6F6",
              "versionEndIncluding": "6.4.7",
              "versionStartIncluding": "6.4.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A56C791-6437-4BA5-922C-3352FF5D8431",
              "versionEndIncluding": "7.0.5",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD3A9BF6-5A5E-4D25-BDB4-CD9AA9DA8580"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22B39FED-3BE4-4362-A071-93A235CE6089"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "235B3CB6-E9A3-4849-AF87-954693BA2EDE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}