CVE-2019-15707

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 23, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-157086.7A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.CVE-2019-157096.5An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorCVE-2019-15714.8The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the RADIUS serverCVE-2019-157107.2An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized adminiCVE-2019-157117.8A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands unCVE-2019-157127.2An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to accessCVE-2019-157136.1The my-calendar plugin before 3.1.10 for WordPress has XSS.CVE-2019-157145.3cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory traversal attack in unCVE-2019-157157.2MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.CVE-2019-157165.5WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys iCVE-2019-157179.8Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.CVE-2019-157184.4In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus
CVE-2019-15707: Medium severity, CVSS 4.9 | Vulnix