description: An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPs requests.
problem types: Information disclosure
affected:
{
vendor: Fortinet
product: FortiMail
defaultStatus: unaffected
versions:
versionType: semver, version: 7.2.0, lessThanOrEqual: 7.2.2, status: affected
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.5, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.8, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.9, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.12, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:F/RL:X/RC:C
]
solutions: Please upgrade to FortiMail version 7.4.0 or above
Please upgrade to FortiMail version 7.2.3 or above
Please upgrade to FortiMail version 7.0.6 or above