Fortinet FortiMail Cryptographically Weak Random Number Generator Vulnerability in Identity Based Encryption Service

A vulnerability has been identified in Fortinet FortiMail versions 6.4.0 to 6.4.4 and 6.2.0 to 6.2.7. This vulnerability arises from the use of a cryptographically weak pseudo-random number generator in the authenticator of the Identity Based Encryption service. It may allow an unauthenticated attacker to infer parts of users' authentication tokens and reset their credentials.

Impact

Exploitation of this vulnerability could lead to unauthorized inference of authentication token parts, allowing for credential resets.