Observable Response Discrepancy in FortiSOAR and FortiClientEMS - CVE-2024-36510
Published: April 10, 2025 / Updated: May 20, 2025
Vulnerability identifier: #VU107354
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-36510
CWE-ID: CWE-204
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to observable response discrepancy in authentication component. An unauthenticated attacker can enumerate valid users via observing login request responses.
Affected software
FortiSOAR
FortiClientEMS
FortiClientEMS
How to mitigate CVE-2024-36510
Install update from vendor's website.
FortiSOAR - addressed in versions 7.3.3, 7.4.5, 7.5.1
FortiClientEMS - addressed in versions 7.2.5, 7.4.1
FortiClientEMS - addressed in versions 7.2.5, 7.4.1