« Volver al listado

CVE-2024-32119

Estado: AnalizadaMedia (4.8)—

An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowledge of the targeted user's FCTUID and VDOM to perform operations such as uploading or tagging on behalf of the targeted user via specially crafted TCP requests.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fortinet — Forticlientems

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32119",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32119",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-10T19:29:57.527258Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "FortiClientEMS",
          "versions": [
            {
              "status": "affected",
              "version": "7.4.0"
            },
            {
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.4"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.13"
            },
            {
              "status": "affected",
              "version": "6.4.7",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.9"
            },
            {
              "status": "affected",
              "version": "6.4.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.4"
            },
            {
              "status": "affected",
              "version": "6.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.9"
            },
            {
              "status": "affected",
              "version": "6.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.4"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-06-10T17:19:14.323",
  "references": [
    {
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-375",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@fortinet.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1390"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowledge of the targeted user's FCTUID and VDOM to perform operations such as uploading or tagging on behalf of the targeted user via specially crafted TCP requests."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de autenticación incorrecta [CWE-287] en Fortinet FortiClientEMS versión 7.4.0 y anteriores a 7.2.4 permite que un atacante no autenticado con conocimiento del FCTUID y VDOM del usuario objetivo realice operaciones como cargar o etiquetar en nombre del usuario objetivo a través de solicitudes TCP especialmente manipuladas."
    }
  ],
  "lastModified": "2026-06-17T07:29:19.150",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46359866-6D0D-4479-A1E6-96EB1753DF6F",
              "versionEndIncluding": "6.2.9",
              "versionStartIncluding": "6.2.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F67F4416-C237-41A2-B7A4-2541EE60C972",
              "versionEndIncluding": "6.4.9",
              "versionStartIncluding": "6.4.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91D4223F-37D4-45D7-A767-2AA8EDAC9AEC",
              "versionEndIncluding": "7.0.13",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9FA0AB2-209D-4C5A-86E8-D5F88816CD60",
              "versionEndExcluding": "7.2.5",
              "versionStartIncluding": "7.2.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlientems:7.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22665641-9DD6-42BB-81E2-52E03153E114"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}