Fortinet Fortinet FortiMail
At a glance
- Source
- NVD
- EPSS
- EPSS 1.33 % · percentile 71 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- fortinet
- NVD status
- Modified
Description
A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests.
Weaknesses (CWE)
- CWE-401 — Missing Release of Memory after Effective Lifetime
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | fortinet |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · psirt@fortinet.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-12911
- GCVE · GCVE-0-2021-26090
CERT-FR advisories
- CERTFR-2021-AVI-510 — Multiples vulnérabilités dans les produits Fortinet · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*≥ 6.2.0 ≤ 6.2.6cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*≥ 6.4.0 < 6.4.5
Affected products
| Product | Versions |
|---|---|
| Fortinet · Fortinet FortiMail | affected FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |