CVE-2023-36633

Name of the Vulnerable Software and Affected Versions FortiMail webmail versions 7.2.0 through 7.2.2 FortiMail webmail versions prior to 7.0.5

Description The issue allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPS requests. This is due to an improper authorization vulnerability.

Recommendations For FortiMail webmail versions 7.2.0 through 7.2.2, update to a version outside of this range to resolve the issue. For FortiMail webmail versions prior to 7.0.5, update to version 7.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the address book folders to minimize the risk of exploitation.