CVE-2024-36510

An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5.0, 7.4.0 through 7.4.4, 7.3.0 through 7.3.2, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to enumerate valid users via observing login request responses.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-24-071	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:forticlientems::::::::
	cpe:2.3:a:fortinet:forticlientems:7.4.0:::::::*
	cpe:2.3:a:fortinet:fortisoar::::::::
	cpe:2.3:a:fortinet:fortisoar::::::::
	cpe:2.3:a:fortinet:fortisoar:7.5.0:::::::*

History

No history.

Information

Published : 2025-01-14 14:15

Updated : 2025-01-31 16:30

NVD link : CVE-2024-36510

Mitre link : CVE-2024-36510

CVE.ORG link : CVE-2024-36510

JSON object : View

Products Affected

fortinet

forticlientems
fortisoar

CWE

CWE-204

Observable Response Discrepancy

CWE-203

Observable Discrepancy

{"id": "CVE-2024-36510", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-01-14T14:15:30.737", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-071", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-204"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5.0, 7.4.0 through 7.4.4, 7.3.0 through 7.3.2, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to enumerate valid users via observing login request responses."}, {"lang": "es", "value": "Una vulnerabilidad de discrepancia de respuesta observable [CWE-204] en FortiClientEMS 7.4.0, 7.2.0 a 7.2.4, 7.0 todas las versiones, y FortiSOAR 7.5.0, 7.4.0 a 7.4.4, 7.3.0 a 7.3.2, 7.2 todas las versiones, 7.0 todas las versiones, 6.4 todas las versiones puede permitir que un atacante no autenticado enumere usuarios v\u00e1lidos mediante la observaci\u00f3n de las respuestas de las solicitudes de inicio de sesi\u00f3n."}], "lastModified": "2025-01-31T16:30:50.753", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D79D035D-4F5F-439B-82C3-C640086C7B40", "versionEndExcluding": "7.2.5", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:fortinet:forticlientems:7.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22665641-9DD6-42BB-81E2-52E03153E114"}, {"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3ECE9A3F-7C5F-4A34-ABB2-CD4E1997CE0E", "versionEndExcluding": "7.3.3", "versionStartIncluding": "6.4.0"}, {"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "265BEE92-3FBB-4033-A77A-E112C9DE9862", "versionEndExcluding": "7.4.5", "versionStartIncluding": "7.4.0"}, {"criteria": "cpe:2.3:a:fortinet:fortisoar:7.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCA9F69D-D91E-4450-97BD-D9566EA7B649"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}