An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated attacker to impersonate an existing user by intercepting and re-using valid SAML authentication messages.
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Forticlient_enterprise_management_server | Fortinet | 6.2.0 (including) | 6.2.9 (including) |
| Forticlient_enterprise_management_server | Fortinet | 6.4.0 (including) | 6.4.4 (including) |
| Forticlient_enterprise_management_server | Fortinet | 7.0.0 (including) | 7.0.0 (including) |
| Forticlient_enterprise_management_server | Fortinet | 7.0.1 (including) | 7.0.1 (including) |