CVE-2023-47539: Critical severity Fortinet FortiMail vulnerability

Published Mar 18, 2025

Updated

An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remotewildcard enabled may allow a remote unauthenticated attacker to bypass admin login via a crafted HTTP request.

Affected Software

2 affected components

Fortinet FortiMail

Fortinet FortiMail=7.4.0

Remediation

Information

Please upgrade to FortiMail version 7.4.1 or above

Event History

Mar 18, 2025

CVE Published

via MITRE·01:56 PM

Data Sourced

via MITRE·01:56 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-47539?

CVE-2023-47539 is classified as a critical vulnerability due to its potential to allow unauthorized remote access.

How do I fix CVE-2023-47539?

To remediate CVE-2023-47539, update FortiMail to the latest version that addresses the vulnerability.

Who is affected by CVE-2023-47539?

CVE-2023-47539 affects FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled.

What attack vector does CVE-2023-47539 utilize?

CVE-2023-47539 can be exploited via crafted HTTP requests from a remote unauthenticated attacker.

What is the potential impact of CVE-2023-47539?

The exploitation of CVE-2023-47539 may result in bypassing the admin login and accessing sensitive configurations.