« Volver al listado

CVE-2024-45326

Estado: ModificadaMedia (4.3)—

An Improper Access Control vulnerability [CWE-284] vulnerability in Fortinet FortiDeceptor 6.0.0, FortiDeceptor 5.3 all versions, FortiDeceptor 5.2 all versions, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions may allow an authenticated attacker with none privileges to perform operations on the central management appliance via crafted requests.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fortinet — Fortideceptor

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-45326",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45326",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-14T15:14:59.021895Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortideceptor:6.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortideceptor:5.3.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortideceptor:5.3.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortideceptor:5.3.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortideceptor:5.3.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortideceptor:5.3.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortideceptor:5.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortideceptor:5.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortideceptor:5.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortideceptor:5.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortideceptor:5.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "Fortinet",
          "product": "FortiDeceptor",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.0"
            },
            {
              "status": "affected",
              "version": "5.3.0",
              "versionType": "semver",
              "lessThanOrEqual": "5.3.4"
            },
            {
              "status": "affected",
              "version": "5.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "5.2.2"
            },
            {
              "status": "affected",
              "version": "5.1.0"
            },
            {
              "status": "affected",
              "version": "5.0.0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-01-14T14:15:31.183",
  "references": [
    {
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-285",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@fortinet.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Improper Access Control vulnerability [CWE-284] vulnerability in Fortinet FortiDeceptor 6.0.0, FortiDeceptor 5.3 all versions, FortiDeceptor 5.2 all versions, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions may allow an authenticated attacker with none privileges to perform operations on the central management appliance via crafted requests."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de control de acceso inadecuado [CWE-284] en FortiDeceptor versión 6.0.0, versión 5.3.3 y anteriores, versión 5.2.1 y anteriores, versión 5.1.0, versión 5.0.0 puede permitir que un atacante autenticado sin privilegios realice operaciones en el dispositivo de administración central a través de solicitudes manipuladas."
    }
  ],
  "lastModified": "2026-06-17T07:54:02.060",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortideceptor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19ED7397-1BD2-4C31-AA38-044A316CDD93",
              "versionEndExcluding": "6.0.1",
              "versionStartIncluding": "5.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}