VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 9, 2021· Updated Jun 17, 2026

CVE-2021-24020

CVE-2021-24020

Description

A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification.

Affected products

3
  • Fortinet/Fortimail3 versions
    cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*range: >=6.2.0,<=6.2.7
    • (no CPE)range: 6.4.0 - 6.4.4, 6.2.0 - 6.2.7
    • (no CPE)range: FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.