Unscored severity · published Apr 14, 2015
CVE-2015-3293
FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command
–
CVSS
1%
EPSS
No
On KEV
Description
FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fortimail · Fortinet
5.0.3; 5.0.4; 5.0.5; 5.0.6; 5.0.7; 5.1; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3293
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3293
Vendor Advisory
http://www.fortiguard.com/advisory/FG-IR-15-009/
www.securitytracker.com
http://www.securitytracker.com/id/1032185
More from Fortimail
9.8
CVE-2026-104286
Fortinet FortiMail Path Traversal Vulnerability
9.8
CVE-2025-32756
Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
9.8
CVE-2023-47539
An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may allow a remote unauthenticated attacker…
9.8
CVE-2021-32586
An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the environment of the…
9.8
CVE-2021-36166
An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of…