CVE-2021-24020
A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed...
Affects 1 product across 1 vendor.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A critical vulnerability in FortiMail versions 6.4.0 through 6.4.4 and 6.2.0 through 6.2.7 allows unauthenticated attackers to tamper with signed URLs, bypassing signature verification due to a missing cryptographic step in the hash digest algorithm implementation.
BSID: BS-2021-GLOBAL-228085-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2021-24020?
What is the CVSS score for CVE-2021-24020?
Is CVE-2021-24020 actively exploited?
How do I remediate CVE-2021-24020?
What systems are affected by CVE-2021-24020?
| CVE ID | CVE-2021-24020 |
|---|---|
| BSID | BS-2021-GLOBAL-228085-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2021-07-09 |
| Last Modified | 2024-11-21 |
| ICS Relevance | 55% |
| Weakness (CWE) | |
| Domains | |
| Source | NVD |
A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification.
Source: NIST NVD / MITRE CVE Database
The attack vector involves an unauthenticated attacker appending additional data to signed URLs, exploiting a missing cryptographic step in the hash digest algorithm. This allows the attacker to bypass the signature verification process, potentially leading to unauthorized access or manipulation of the signed content.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Fixed Version |
|---|---|---|
| Fortinet | Fortimail | — |
No patch URL on record. Monitor vendor security advisories directly.
| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
SAGE Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | d684c561cbf1a1a9daaefa7718ef53d1546fafc75cc3075f962e784cc035860c0c7bfcf01ae4b98e480f452b1dc29bdbf7b8e44d14c992af5c30612a5f28b242 |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Check Your Assets Free →