FortiMailに脆弱性7件 認証不要、悪用は未確認
Summary
FortiMailに、認証なしで悪用できる深刻な脆弱性が7件公表されました。3件はコード実行、4件はメール利用者のアカウント奪取につながります。自社運用の組織は版を確認し、修正版への更新を急いでください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
FortiMailに、認証なしで悪用できる深刻な脆弱性が7件公表されました。3件はコード実行、4件はメール利用者のアカウント奪取につながります。自社運用の組織は版を確認し、修正版への更新を急いでください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| FortinetFortiMail |
8.0.0 – 8.0.1→ Not listed 7.6.0 – 7.6.6→ Not listed |
Not listed Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web fortiguard.fortinet.com
- web nvd.nist.gov
- web github.com