CVE-2024-21753CWE-22path-traversal

CVE-2024-21753

Medium · published September 10, 2024

CVSS v3.1
5.5
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.4, FortiClientEMS 7.0 all versions, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions, FortiClientEMS 01.02.02 through 01.02.05 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00741 · 54.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-09-10T19:15Z
Affected products (6)
ProductVersionsFixed in
fortinet/forticlient_endpoint_management_server≥ 1.2.1, ≤ 1.2.5—
fortinet/forticlient_endpoint_management_server≥ 6.0.0, ≤ 6.0.8—
fortinet/forticlient_endpoint_management_server≥ 6.2.0, ≤ 6.2.9—
fortinet/forticlient_endpoint_management_server≥ 6.4.0, ≤ 6.4.9—
fortinet/forticlient_endpoint_management_server≥ 7.0.0, ≤ 7.0.13—
fortinet/forticlient_endpoint_management_server≥ 7.2.0, ≤ 7.2.4—
References (1)
https://fortiguard.fortinet.com/psirt/FG-IR-23-362 · [email protected]
EPSS history
Timeline
  • 10 SEP 14:37Z
    A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13…
    cvelistv5