CVE-2023-47539
Published: 18 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2023-47539 is an improper access control vulnerability (CWE-284) in FortiMail version 7.4.0 when configured with RADIUS authentication and the remote_wildcard option enabled. This issue allows a remote unauthenticated attacker to bypass administrative login via a crafted HTTP request. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and potential for high impacts across confidentiality, integrity, and availability.
A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to the targeted FortiMail instance under the specified configuration. Successful exploitation grants unauthorized administrative access, enabling the attacker to perform privileged actions on the device.
Mitigation details are available in the FortiGuard PSIRT advisory at https://fortiguard.com/psirt/FG-IR-23-439.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is an authentication bypass in a public-facing FortiMail web interface, directly enabling initial access via exploitation of a public-facing application (T1190).