« Volver al listado

CVE-2024-33508

Estado: AnalizadaAlta (7.3)—

An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in Fortinet FortiClientEMS 7.2.0 through 7.2.4, 7.0.0 through 7.0.12 may allow an unauthenticated attacker to execute limited and temporary operations on the underlying database via crafted requests.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fortinet — Forticlient Enterprise Management Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-33508",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-33508",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-10T17:28:56.999080Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "FortiClientEMS",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.4"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.12"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*"
          ],
          "vendor": "fortinet",
          "product": "forticlient_endpoint_management_server",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.0",
              "versionType": "custom",
              "lessThanOrEqual": "7.2.4"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "7.0.12"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-10T15:15:16.187",
  "references": [
    {
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-123",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@fortinet.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in Fortinet FortiClientEMS 7.2.0 through 7.2.4, 7.0.0 through 7.0.12 may allow an unauthenticated attacker to execute limited and temporary operations on the underlying database via crafted requests."
    },
    {
      "lang": "es",
      "value": "Una neutralización incorrecta de elementos especiales utilizados en una vulnerabilidad de comando ('Inyección de comando') [CWE-77] en Fortinet FortiClientEMS 7.2.0 a 7.2.4, 7.0.0 a 7.0.12 puede permitir que un atacante no autenticado ejecute operaciones limitadas y temporales en la base de datos subyacente a través de solicitudes manipuladas. "
    }
  ],
  "lastModified": "2026-06-17T07:31:53.367",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient_enterprise_management_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "806EBE90-88D2-44AC-B7F5-1C0598E08A67",
              "versionEndExcluding": "7.0.13",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient_enterprise_management_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1978E3A0-128F-4982-87C0-9AD4FB67F9B9",
              "versionEndExcluding": "7.2.5",
              "versionStartIncluding": "7.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}