6.5
Medium
CVE-2024-56497 An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail…
Description
An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7.2.4 and 7.0.0 through 7.0.6 and 6.4.0 through 6.4.7, FortiRecorder versions 7.0.0 and 6.4.0 through 6.4.4 allows attacker to execute unauthorized code or commands via the CLI.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiMail 7.2 | 7.2.0 → 7.2.4 | No fix stated |
| FortiMail 7.0 | 7.0.0 → 7.0.6 | No fix stated |
| FortiMail 6.4 | 6.4.0 → 6.4.7 | No fix stated |
| FortiRecorder | 7.0.0 | No fix stated |
| FortiRecorder 6.4 | 6.4.0 → 6.4.4 | No fix stated |
References
- fortiguard.fortinet.com fortiguard.fortinet.com
Timeline
- Published
- Last modified
Other CVEs of FortiMail
The 24 CVEs of FortiMail →
CVE-2025-57739
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89]…
7.7
High
CVE-2026-104286
Fortinet FortiMail Path Traversal Vulnerability
9.8
Critical
CVE-2025-53681
An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89]…
6.3
Medium
CVE-2025-55717
A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through…
3.8
Low