CVE-2023-36633 is an improper authorization vulnerability affecting FortiMail webmail versions 7.2.0 through 7.2.2 and before 7.0.5. An authenticated attacker can exploit this flaw to view and alter the titles of other users' address book folders through crafted HTTP/S requests. With a CVSS score of 5.4 (Medium), this vulnerability has a low attack complexity and requires authentication, leading to limited impact on confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.0.0, < 7.0.6CPE matchmatch criteria | cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* | ||
>= 7.2.0, < 7.2.3CPE matchmatch criteria | cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* | ||
>= 6.0.0, <= 6.0.12CPE match | cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* | ||
>= 6.2.0, <= 6.2.9CPE match | cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* | ||
>= 6.4.0, <= 6.4.8CPE match | cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.