« Volver al listado

CVE-2024-46663

Estado: AnalizadaMedia (6.7)—

A stack-buffer overflow vulnerability [CWE-121] in Fortinet FortiMail CLI version 7.6.0 through 7.6.1 and before 7.4.3 allows a privileged attacker to execute arbitrary code or commands via specifically crafted CLI commands.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fortinet — Fortimail

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-46663",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-46663",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-12T04:00:59.848767Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:6.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:6.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:6.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:6.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:6.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:6.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:6.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:6.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimail:6.4.0:*:*:*:*:*:*:*"
          ],
          "vendor": "Fortinet",
          "product": "FortiMail",
          "versions": [
            {
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.6.1"
            },
            {
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.4.3"
            },
            {
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.7"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.8"
            },
            {
              "status": "affected",
              "version": "6.4.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.8"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-03-11T15:15:42.130",
  "references": [
    {
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-331",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@fortinet.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A stack-buffer overflow vulnerability [CWE-121] in Fortinet FortiMail CLI version 7.6.0 through 7.6.1 and before 7.4.3 allows a privileged attacker to execute arbitrary code or commands via specifically crafted CLI commands."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desbordamiento de búfer de pila [CWE-121] en Fortinet FortiMail CLI versión 7.6.0 a 7.6.1 y anteriores a 7.4.3 permite que un atacante privilegiado ejecute código o comandos arbitrarios a través de comandos CLI específicamente manipulados."
    }
  ],
  "lastModified": "2026-06-17T07:55:40.920",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74AF12D9-13B8-4849-A974-5C9B208BB02F",
              "versionEndExcluding": "7.2.7",
              "versionStartIncluding": "6.4.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "187F5F30-2F5C-4E5B-9FED-F46D89D67D95",
              "versionEndExcluding": "7.4.4",
              "versionStartIncluding": "7.4.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F48F8EA0-53FE-41F3-8C6E-169B8CE6FBD7",
              "versionEndExcluding": "7.6.2",
              "versionStartIncluding": "7.6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}