CVE-2024-35281

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-35281", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2024-05-14T21:15:19.190Z", "datePublished": "2025-05-13T14:46:42.574Z", "dateUpdated": "2025-05-13T15:17:58.536Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiClientMac", "cpes": [], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "7.4.0", "lessThanOrEqual": "7.4.2", "status": "affected"}, {"versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.8", "status": "affected"}, {"versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.14", "status": "affected"}]}, {"vendor": "Fortinet", "product": "FortiVoiceUCDesktop", "cpes": [], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "3.0.0", "lessThanOrEqual": "3.0.16", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and FortiVoiceUCDesktop 3.0 all versions desktop application may allow an authenticated attacker to inject code via Electron environment variables."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2025-05-13T14:46:42.574Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-653", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiClientMac version 7.4.3 or above \nPlease upgrade to FortiClientMac version 7.2.9 or above \nPlease upgrade to FortiVoiceUCDesktop version 7.0.0 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-025", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-025"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-13T15:17:53.581796Z", "id": "CVE-2024-35281", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-13T15:17:58.536Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35281", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-13T15:17:53.581796Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-13T15:17:56.064Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": [], "vendor": "Fortinet", "product": "FortiClientMac", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "semver", "lessThanOrEqual": "7.4.2"}, {"status": "affected", "version": "7.2.0", "versionType": "semver", "lessThanOrEqual": "7.2.8"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.14"}], "defaultStatus": "unaffected"}, {"cpes": [], "vendor": "Fortinet", "product": "FortiVoiceUCDesktop", "versions": [{"status": "affected", "version": "3.0.0", "versionType": "semver", "lessThanOrEqual": "3.0.16"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiClientMac version 7.4.3 or above \nPlease upgrade to FortiClientMac version 7.2.9 or above \nPlease upgrade to FortiVoiceUCDesktop version 7.0.0 or above"}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-025", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-025"}], "descriptions": [{"lang": "en", "value": "An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and FortiVoiceUCDesktop 3.0 all versions desktop application may allow an authenticated attacker to inject code via Electron environment variables."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-653", "description": "Execute unauthorized code or commands"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2025-05-13T14:46:42.574Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35281", "state": "PUBLISHED", "dateUpdated": "2025-05-13T15:17:58.536Z", "dateReserved": "2024-05-14T21:15:19.190Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2025-05-13T14:46:42.574Z", "assignerShortName": "fortinet"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FortiClientMac", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "7.4.2", "status": "affected", "version": "7.4.0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.8", "status": "affected", "version": "7.2.0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.14", "status": "affected", "version": "7.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "FortiVoiceUCDesktop", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "3.0.16", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:*", "matchCriteriaId": "6C849529-C78C-4DE7-B2EA-FFF29FF9972F", "versionEndExcluding": "7.2.9", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:*", "matchCriteriaId": "96EF5BCC-56D3-4218-80A2-085F8B63D83A", "versionEndExcluding": "7.4.3", "versionStartIncluding": "7.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortifone_softclient:*:*:*:*:desktop:-:*:*", "matchCriteriaId": "6CE41DB7-AA21-42E2-84E1-52C724DF54DB", "versionEndIncluding": "3.0.16", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and FortiVoiceUCDesktop 3.0 all versions desktop application may allow an authenticated attacker to inject code via Electron environment variables."}, {"lang": "es", "value": "Una vulnerabilidad de aislamiento o compartimentaci\u00f3n inadecuada [CWE-653] en la aplicaci\u00f3n de escritorio FortiClientMac versi\u00f3n 7.4.2 y anteriores, versi\u00f3n 7.2.8 y anteriores, 7.0 todas las versiones y FortiVoiceUCDesktop 3.0 todas las versiones puede permitir que un atacante autenticado inyecte c\u00f3digo a trav\u00e9s de variables de entorno de Electron."}], "id": "CVE-2024-35281", "lastModified": "2026-06-17T07:34:40.707", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 1.4, "source": "psirt@fortinet.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35281", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-13T15:17:53.581796Z", "version": "2.0.3"}}]}, "published": "2025-05-13T15:15:52.060", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-025"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-653"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}

{}