Fortinet FortiMail Webmail Password Reset Vulnerability

A weak password recovery mechanism for forgotten passwords in Fortinet FortiMail may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.

Affected versions:

• FortiMail 8.0.0
• FortiMail 7.6.0 through 7.6.5
• FortiMail 7.4.0 through 7.4.7
• FortiMail 7.2.0 through 7.2.9