PT-2023-5166 · Fortinet · Forticlientems
CVE-2021-44172
·
Publicado
2023-08-30
·
Atualizado
2023-09-15
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
FortiClientEMS versions 7.0.0 through 7.0.4
FortiClientEMS versions 7.0.6 through 7.0.7
FortiClientEMS versions 6.4 and earlier
FortiClientEMS versions 6.2 and earlier
Description
The issue is related to an exposure of sensitive information to an unauthorized actor, which may allow an unauthenticated attacker to gain information on environment variables, such as the EMS installation path. This is due to insufficient protection of service data. The vulnerability can be exploited by a remote attacker to gain unauthorized access to protected information.
Recommendations
For FortiClientEMS versions 7.0.0 through 7.0.4, update to a version outside of this range to mitigate the risk.
For FortiClientEMS versions 7.0.6 through 7.0.7, update to a version outside of this range to mitigate the risk.
For FortiClientEMS versions 6.4 and earlier, update to a version later than 6.4 to mitigate the risk.
For FortiClientEMS versions 6.2 and earlier, update to a version later than 6.2 to mitigate the risk.
As a temporary workaround, consider restricting access to the management interface to minimize the risk of exploitation.
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Forticlientems