CVEvulnerability
CVE-2021-22129
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-07-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-120
Description
Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.
Affected configurations
• fortinet fortimail (<= 5.4.12)
• fortinet fortimail (>= 5.6.1 < 6.0.11)
• fortinet fortimail (>= 6.2.0 < 6.2.7)
• fortinet fortimail (>= 6.4.0 < 6.4.5)
Related
Weakness · CWE (1)
- CWE-120 Buffer Copy without Checking Size of Input weakness
References
- https://fortiguard.com/advisory/FG-IR-21-023 Vendor Advisory
- https://fortiguard.com/advisory/FG-IR-21-023 Vendor Advisory