CVE-2021-36166 CRITICAL

CVE-2021-36166

Vendor Fortinet
Product Fortinet FortiMail
Published March 1, 2022
Last update October 25, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C

What the vulnerability does

01Description

An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties.

Key dates

02Disclosure timeline

March 1, 2022 CVE published
October 25, 2024 Record updated