FortiMail argument injection lets privileged admins run root commands
Original title: Improper neutralization of special elements used in a command
Domain or system admins can also delete users on a paired FortiAuthenticator and read or write files as root.
Fortinet reports an argument-injection flaw in FortiMail scored CVSS v3 7.6. An authenticated remote attacker who already has domain admin or admin privileges can send crafted HTTP requests to the administrative interface. Possible results include root code execution, arbitrary CLI commands, and reading or writing arbitrary files as root. Advisory FG-IR-26-218 was revised on November 10.
Unconfirmed: Affected versions, fixes, CVE identifiers and exploitation status are not stated.
- The flaw is CWE-88 argument injection.
- Fortinet tracks it as FG-IR-26-218.
- The attacker must already hold domain admin or admin rights.
- Requests target the administrative HTTP interface.
Impact: root code execution and cross-tenant user deletion
| Product | Affected |
|---|---|
| Fortinet FortiMail | — |
- Vendors
- Fortinet
- Products
- FortiMailFortiAuthenticator
From the original article
CVSSv3 Score: 7.
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.