Fortinet PSIRT Monthly Advisories — July 2021
Tuesday, 13 July 2021
- Vulnerabilities
- 6
- Critical
- 0
- High
- 3
- Zero-days
- 0
- Public exploit
- 1
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
Public exploit code 1
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
All vulnerabilities 6
High3 ShowHide
-
High 8.8
CVE-2021-24013 Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via s…EPSS 1.1%
-
High 7.2
CVE-2021-24015 An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authe…EPSS 1.2%
-
High 7.1
CVE-2021-26088 Public exploit An improper authentication vulnerability in FSSO Collector version 5.0.295 and below may allow an unauthenticated user to bypass a FSSO firewall policy and acc…EPSS 1%
Medium3 ShowHide
- Medium 6.7
-
Medium 5.3
CVE-2021-26090 A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an una…EPSS 1.3%
- Medium 4.4