CVE-2021-26095
 
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges.
Una combinación de varios problemas criptográficos en la administración de sesiones de FortiMail versiones 6.4.0 hasta 6.4.4 y versiones 6.2.0 hasta 6.2.6, incluyéndo la construcción del cifrado de la cookie de sesión, puede permitir a un atacante remoto que ya esté en posesión de una cookie, a posiblemente revelar y alterar o falsificar su contenido, escalando así los privilegios
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-01-25 CVE Reserved
- 2021-07-20 CVE Published
- 2023-10-12 EPSS Updated
- 2024-10-25 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://fortiguard.com/advisory/FG-IR-21-019 | 2023-08-08 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Fortinet Search vendor "Fortinet" | Fortimail Search vendor "Fortinet" for product "Fortimail" | >= 6.2.0 <= 6.2.6 Search vendor "Fortinet" for product "Fortimail" and version " >= 6.2.0 <= 6.2.6" | - |
Affected
| ||||||
Fortinet Search vendor "Fortinet" | Fortimail Search vendor "Fortinet" for product "Fortimail" | >= 6.4.0 < 6.4.5 Search vendor "Fortinet" for product "Fortimail" and version " >= 6.4.0 < 6.4.5" | - |
Affected
|