Session Management Vulnerability in FortiMail 6.4.0 - 6.4.4 and 6.2.0 - 6.2.6
CVE-2021-26095 · HIGH Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges.
Learn more about our Web Application Penetration Testing UK.