Summary
Fortinet heeft meerdere kwetsbaarheden verholpen in FortiMail.
Details
Interpretaties
De kwetsbaarheden in FortiMail betreffen onder andere OS command injection, path traversal, SQL-injectie, authenticatie- en autorisatieproblemen, argument injection, XML-injectie, en resource consumptie. Sommige kwetsbaarheden kunnen door ongeauthenticeerde aanvallers worden misbruikt, terwijl andere authenticatie vereisen. Exploitatie kan leiden tot het uitvoeren van ongeautoriseerde commando's op root-niveau, het omzeilen van authenticatie en autorisatie, het resetten van wachtwoorden van webmailgebruikers, het lezen en verzenden van versleutelde e-mails namens andere gebruikers, het verwijderen van gebruikers in multi-tenant omgevingen, en het veroorzaken van denial-of-service door crashes of resource uitputting. De kwetsbaarheden beïnvloeden verschillende versies van FortiMail, met name versies tussen 7.2 en 8.0.2, en hebben impact op kernfunctionaliteiten zoals mailverwerking, webmailinterfaces, administratieve interfaces, en integratie met FortiAuthenticator.
Oplossingen
Fortinet heeft updates uitgebracht om de kwetsbaarheden in FortiMail te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 27
-
Critical 9.8CVE-2026-126147 Public exploit
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.…
-
Critical 9.8CVE-2026-126148 Public exploit
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
Critical 9.4
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiM…
-
Critical 9.4
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiM…
-
Critical 9.1
A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 th…
-
Critical 9.1
A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, Forti…
-
Critical 9.1
A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7…
-
Critical 9.1
A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, Forti…
-
High 8.8
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
High 8.7
A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 th…
-
High 8.2
A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, Forti…
-
High 8.1
A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote…
-
High 7.6
A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7…
-
High 7.5
A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6…
-
High 7.5
A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMa…
-
High 7.5
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.…
-
High 7.5
A out-of-bounds write vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail…
-
High 7.5
A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7…
-
High 7.5
A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.…
-
High 7.5
A memory allocation with excessive size value vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 …
-
High 7.2
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
High 7.2
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
High 7.2
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
High 7.2
A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMai…
-
High 7.2
A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMa…
-
High 7.2
A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMai…
-
High 7.2
A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMai…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-196
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-197
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-198
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-199
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-200
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-201
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-202
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-203
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-204
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-205
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-206
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-207
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-208
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-209
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-210
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-211
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-212
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-213
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-214
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-215
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-216
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-217
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-218
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-277