PT-2024-9822 · Fortinet · Forticlientems

Published

2024-09-10

·

Updated

2024-09-25

·

CVE-2024-21753

CVSS v2.0

8.0

High

VectorAV:N/AC:L/Au:S/C:P/I:P/A:C
Name of the Vulnerable Software and Affected Versions: Fortinet FortiClientEMS versions 1.2.1 through 1.2.5 Fortinet FortiClientEMS versions 6.0.0 through 6.0.8 Fortinet FortiClientEMS versions 6.2.0 through 6.2.9 Fortinet FortiClientEMS versions 6.4.0 through 6.4.9 Fortinet FortiClientEMS versions 7.0.0 through 7.0.13 Fortinet FortiClientEMS versions 7.2.0 through 7.2.4
Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'path traversal', in Fortinet FortiClientEMS. This allows an attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests.
Recommendations: For Fortinet FortiClientEMS versions 1.2.1 through 1.2.5, update to a version that fixes the path traversal issue. For Fortinet FortiClientEMS versions 6.0.0 through 6.0.8, update to a version that fixes the path traversal issue. For Fortinet FortiClientEMS versions 6.2.0 through 6.2.9, update to a version that fixes the path traversal issue. For Fortinet FortiClientEMS versions 6.4.0 through 6.4.9, update to a version that fixes the path traversal issue. For Fortinet FortiClientEMS versions 7.0.0 through 7.0.13, update to a version that fixes the path traversal issue. For Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, update to a version that fixes the path traversal issue. As a temporary workaround, consider restricting access to the vulnerable HTTP endpoints until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-11598
CVE-2024-21753

Affected Products

Forticlientems