CVE-2020-15933: Unauthenticated user can determine software-version information
A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versions 6.4.1 and 6.4.0 allows attacker to obtain potentially sensitive software-version information via client-side resources inspection.
Other sources
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiMail may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file.
— FortiGuard
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-15933?
CVE-2020-15933 is a vulnerability that allows an unauthorized actor to obtain potentially sensitive software-version information in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below, and FortiMail versions 6.4.1 and 6.4.0.
How severe is CVE-2020-15933?
CVE-2020-15933 has a severity rating of 5.3, which is considered medium.
What is the affected software for CVE-2020-15933?
The affected software for CVE-2020-15933 includes Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below, and FortiMail versions 6.4.1 and 6.4.0.
How can an unauthorized actor exploit CVE-2020-15933?
An unauthorized actor can exploit CVE-2020-15933 by inspecting client-side resources to obtain potentially sensitive software-version information.
Is there a fix for CVE-2020-15933?
Yes, Fortinet has released updates to address the vulnerability in FortiMail versions 6.0.10, 6.2.5, and 6.4.2. It is recommended to update to the latest version to mitigate the risk.