description: An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment with junk and pad characters in base64.
problem types: Denial of service
affected:
{
vendor: Fortinet
product: Fortinet AV Engine, FortiMail, FortiOS, FortiClient
versions:
version: AV Engine version 6.2.168 and below and version 6.4.274 and below., status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N/E:P/RL:U/RC:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
remediationLevel: UNAVAILABLE
reportConfidence: REASONABLE
baseScore: 4.7
temporalScore: 4.3
baseSeverity: MEDIUM
temporalSeverity: MEDIUM
]