description: An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to  perform a brute force attack on the affected endpoints via repeated login attempts.
problem types: Improper access control
affected:
{
vendor: Fortinet
product: FortiMail
defaultStatus: unaffected
versions:
version: 7.4.0, status: affected
versionType: semver, version: 7.2.0, lessThanOrEqual: 7.2.4, status: affected
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.6, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.8, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.9, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
]
solutions: Please upgrade to FortiMail version 7.4.1 or above
Please upgrade to FortiMail version 7.2.5 or above
Please upgrade to FortiMail version 7.0.7 or above
Please upgrade to FortiMail version 6.4.9 or above