by Kastro
Paper/Archive/CVE-2021-36166

CVE-2021-36166

Fortinet Fortinet FortiMail — An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative ac…

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 73.8.738 × 2014.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties.

Affected

ProductAffectedFixed inSource
Fortinet FortiMailFortiMail before 7.0.1–CNA

Scores by source

fortinet (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-21-028