Fortinet FortiMail up to 7.4.0 Webmail excessive authentication

Summaryinfo

A vulnerability was found in Fortinet FortiMail up to 6.2.9/6.4.8/7.0.6/7.2.4/7.4.0 and classified as problematic. The impacted element is an unknown function of the component Webmail. Such manipulation leads to excessive authentication. This vulnerability is documented as CVE-2023-45582. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Fortinet FortiMail up to 6.2.9/6.4.8/7.0.6/7.2.4/7.4.0. It has been rated as problematic. Affected by this issue is an unknown code of the component Webmail. The manipulation with an unknown input leads to a excessive authentication vulnerability. Using CWE to declare the problem leads to CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. Impacted is confidentiality. CVE summarizes:

An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to  perform a brute force attack on the affected endpoints via repeated login attempts.

The weakness was released 11/14/2023 as FG-IR-23-287. The advisory is available at fortiguard.com. This vulnerability is handled as CVE-2023-45582 since 10/09/2023. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1110.001 by the MITRE ATT&CK project.

Upgrading eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Fortinet

Name

• FortiMail

Version

• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7
• 6.2.8
• 6.2.9
• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4
• 6.4.5
• 6.4.6
• 6.4.7
• 6.4.8
• 7.0
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.1
• 7.2
• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.3
• 7.4.0

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion