{"id":"CVE-2023-45582","state":"PUBLISHED","title":"An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allo","description":"An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to  perform a brute force attack on the affected endpoints via repeated login attempts.","publishedAt":"2023-11-14T18:05:34.247Z","updatedAt":"2024-08-30T18:14:28.885Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiMail"],"affected":[{"vendor":"Fortinet","product":"FortiMail","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.4","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.6","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.8","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-23-287"],"weaknesses":["CWE-307"],"ingestedAt":"2026-10-29T20:06:24.729Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/45xxx/CVE-2023-45582.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-45582","state":"PUBLISHED","datePublished":"2023-11-14T18:05:34.247Z","dateUpdated":"2024-08-30T18:14:28.885Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2023-10-09T08:01:29.296Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to  perform a brute force attack on the affected endpoints via repeated login attempts."}],"affected":[{"vendor":"Fortinet","product":"FortiMail","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.4","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.6","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.8","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-287","name":"https://fortiguard.com/psirt/FG-IR-23-287"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-307","lang":"en","description":"Improper access control","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-11-14T18:05:34.247Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiMail version 7.4.1 or above \nPlease upgrade to FortiMail version 7.2.5 or above \nPlease upgrade to FortiMail version 7.0.7 or above \nPlease upgrade to FortiMail version 6.4.9 or above \n"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-287","name":"https://fortiguard.com/psirt/FG-IR-23-287","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T20:21:16.739Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-30T18:14:14.373874Z","id":"CVE-2023-45582","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-30T18:14:28.885Z"}}]}}}