{"id":"CVE-2023-36633","state":"PUBLISHED","title":"An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of ","description":"An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPs requests.","publishedAt":"2023-11-14T18:07:46.082Z","updatedAt":"2024-08-30T18:10:16.620Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:F/RL:X/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiMail"],"affected":[{"vendor":"Fortinet","product":"FortiMail","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.2","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.5","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.8","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.12","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-23-203"],"weaknesses":["CWE-285"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/36xxx/CVE-2023-36633.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-36633","state":"PUBLISHED","datePublished":"2023-11-14T18:07:46.082Z","dateUpdated":"2024-08-30T18:10:16.620Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2023-06-25T18:03:39.225Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPs requests."}],"affected":[{"vendor":"Fortinet","product":"FortiMail","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.2","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.5","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.8","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.12","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-203","name":"https://fortiguard.com/psirt/FG-IR-23-203"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:F/RL:X/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-285","lang":"en","description":"Information disclosure","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-11-14T18:07:46.082Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiMail version 7.4.0 or above \nPlease upgrade to FortiMail version 7.2.3 or above \nPlease upgrade to FortiMail version 7.0.6 or above \n"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-203","name":"https://fortiguard.com/psirt/FG-IR-23-203","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T16:52:53.973Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-30T18:10:02.842844Z","id":"CVE-2023-36633","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-30T18:10:16.620Z"}}]}}}