ID:3066 - Exploit for Weak Password Recovery Mechanism for Forgotten Password in FortiMail and FortiVoice - CVE-2020-9294

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to gain unauthorized access to users' accounts.

The vulnerability exists within the password recovery feature. A remote non-authenticated attacker can request the password change and gain unauthorized access to accounts of other users.

Remediation