CVE-2023-45582

Published: Nov 14, 2023Modified: Jun 17, 2026

7.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: NVD

Description

An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to perform a brute force attack on the affected endpoints via repeated login attempts.

Affected (5)

Products: Fortinet: Fortimail

Fortinet

1 product

Fortimail

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortimail	From 6.2.0 to 6.2.9
Fortinet Fortimail	From 6.4.0 to 6.4.8
Fortinet Fortimail	From 7.0.0 to 7.0.6
Fortinet Fortimail	From 7.2.0 to 7.2.4
Fortinet Fortimail	Version 7.4.0

Related CWEs

CWE-307

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (2)

https://fortiguard.com/psirt/FG-IR-23-287

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-23-287

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.