User enumeration in authentication component Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-24-071 Final 1 1 2025-01-14T00:00:00 Current version 2025-01-14T00:00:00 2025-01-14T00:00:00 An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS and FortiSOAR may allow an unauthenticated attacker to enumerate valid users via observing login request responses. None Information disclosure None Fortinet is pleased to thank Martin Stoynov from AMATAS for reporting this vulnerability under responsible disclosure and Hritik Sateesh from Fortinet Burnaby InfoSec team. FortiClientEMS 7.4.0 FortiClientEMS 7.2.4 FortiClientEMS 7.2.3 FortiClientEMS 7.2.2 FortiClientEMS 7.2.1 FortiClientEMS 7.2.0 FortiClientEMS 7.0.13 FortiClientEMS 7.0.12 FortiClientEMS 7.0.11 FortiClientEMS 7.0.10 FortiClientEMS 7.0.9 FortiClientEMS 7.0.8 FortiClientEMS 7.0.7 FortiClientEMS 7.0.6 FortiClientEMS 7.0.5 FortiClientEMS 7.0.4 FortiClientEMS 7.0.3 FortiClientEMS 7.0.2 FortiClientEMS 7.0.1 FortiClientEMS 7.0.0 FortiSOAR on-premise 7.5.0 FortiSOAR on-premise 7.4.4 FortiSOAR on-premise 7.4.3 FortiSOAR on-premise 7.4.2 FortiSOAR on-premise 7.4.1 FortiSOAR on-premise 7.4.0 FortiSOAR on-premise 7.3.2 FortiSOAR on-premise 7.3.1 FortiSOAR on-premise 7.3.0 FortiSOAR on-premise 7.2.2 FortiSOAR on-premise 7.2.1 FortiSOAR on-premise 7.2.0 FortiSOAR on-premise 7.0.3 FortiSOAR on-premise 7.0.2 FortiSOAR on-premise 7.0.1 FortiSOAR on-premise 7.0.0 FortiSOAR on-premise 6.4.4 FortiSOAR on-premise 6.4.3 FortiSOAR on-premise 6.4.1 FortiSOAR on-premise 6.4.0 CVE-2024-36510 FortiClientEMS-7.4.0 FortiClientEMS-7.2.4 FortiClientEMS-7.2.3 FortiClientEMS-7.2.2 FortiClientEMS-7.2.1 FortiClientEMS-7.2.0 FortiClientEMS-7.0.13 FortiClientEMS-7.0.12 FortiClientEMS-7.0.11 FortiClientEMS-7.0.10 FortiClientEMS-7.0.9 FortiClientEMS-7.0.8 FortiClientEMS-7.0.7 FortiClientEMS-7.0.6 FortiClientEMS-7.0.5 FortiClientEMS-7.0.4 FortiClientEMS-7.0.3 FortiClientEMS-7.0.2 FortiClientEMS-7.0.1 FortiClientEMS-7.0.0 FortiSOAR on-premise-7.5.0 FortiSOAR on-premise-7.4.4 FortiSOAR on-premise-7.4.3 FortiSOAR on-premise-7.4.2 FortiSOAR on-premise-7.4.1 FortiSOAR on-premise-7.4.0 FortiSOAR on-premise-7.3.2 FortiSOAR on-premise-7.3.1 FortiSOAR on-premise-7.3.0 FortiSOAR on-premise-7.2.2 FortiSOAR on-premise-7.2.1 FortiSOAR on-premise-7.2.0 FortiSOAR on-premise-7.0.3 FortiSOAR on-premise-7.0.2 FortiSOAR on-premise-7.0.1 FortiSOAR on-premise-7.0.0 FortiSOAR on-premise-6.4.4 FortiSOAR on-premise-6.4.3 FortiSOAR on-premise-6.4.1 FortiSOAR on-premise-6.4.0 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-24-071 User enumeration in authentication component Reference>