FortiMail - Salted Digest vulnerable to length extension attacks
Summary
A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification.
Affected Products
FortiMail 6.4.4 and below,
FortiMail 6.2.6 and below.
Solutions
Upgrade to FortiMail version 7.0.0.
Upgrade to FortiMail version 6.4.5.