March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – CVE-2021-1234 – Cisco SD-WAN vManage Software Information Disclosure Vulnerability
July 8, 2021
Rewterz Threat Alert – Donot APT Group – IOCs
July 8, 2021
Rewterz Threat Advisory – CVE-2021-1234 – Cisco SD-WAN vManage Software Information Disclosure Vulnerability
July 8, 2021
Rewterz Threat Alert – Donot APT Group – IOCs
July 8, 2021
Severity
High
Analysis Summary
CVE-2021-24015
An improper neutralization of special elements used in an OS Command vulnerability in FortiMail’s administrative interface may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
CVE-2021-22129
Multiple instances of incorrect calculation of buffer size in FortiMail Webmail and Administrative interface may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.
CVE-2021-26090
A missing release of memory after its effective lifetime vulnerability in FortiMail Webmail may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests.
Impact
- Code Execution
- Unauthorized Access
Affected Vendors
Fortinet
Affected Products
- FortiMail 6.4.3
- FortiMail 6.2.6
- FortiMail 6.0.10
- FortiMail 5.4.12
- FortiMail 6.4.4 and below
- FortiMail 6.2.6 and below
- FortiMail 6.0.10 and below
- FortiMail 5.4.12 and below
Remediation
Refer to Fortinet Advisory for patch upgrade, or suggested workaround information