CVE-2021-24020

—

CVSS 3.1

9.8 critical

EPSS

<1%p47

Published

Jul 9, 2021 (Jul 9, 2021)

Modified

Jun 17, 2026

Description

A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification.

Vendors: fortinet
Products: fortimail
Weakness: CWE-347
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.