CVE-2024-21753
Summary
| CVE | CVE-2024-21753 |
|---|---|
| State | PUBLISHED |
| Assigner | fortinet |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-09-10 15:15:14 UTC |
| Updated | 2026-10-22 14:17:34 UTC |
| Description | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.4, FortiClientEMS 7.0 all versions, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions, FortiClientEMS 01.02.02 through 01.02.05 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests |
Risk And Classification
Primary CVSS: v3.1 6 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
Problem Types: CWE-22 | CWE-22 Denial of service
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 6 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H |
| 3.1 | [email protected] | Secondary | 5.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H |
| 3.1 | CNA | CVSS | 5.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:H/RL:U/RC:C |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
HighUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Fortinet | Forticlient Endpoint Management Server | All | All | All | All |
| Application | Fortinet | Forticlient Endpoint Management Server | All | All | All | All |
| Application | Fortinet | Forticlient Endpoint Management Server | All | All | All | All |
| Application | Fortinet | Forticlient Endpoint Management Server | All | All | All | All |
| Application | Fortinet | Forticlient Endpoint Management Server | All | All | All | All |
| Application | Fortinet | Forticlient Endpoint Management Server | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Fortinet | FortiClientEMS | affected 7.2.0 7.2.4 semver | Not specified |
| CNA | Fortinet | FortiClientEMS | affected 7.0.0 7.0.13 semver | Not specified |
| CNA | Fortinet | FortiClientEMS | affected 6.4.7 6.4.9 semver | Not specified |
| CNA | Fortinet | FortiClientEMS | affected 6.4.0 6.4.4 semver | Not specified |
| CNA | Fortinet | FortiClientEMS | affected 6.2.6 6.2.9 semver | Not specified |
| CNA | Fortinet | FortiClientEMS | affected 6.2.3 6.2.4 semver | Not specified |
| CNA | Fortinet | FortiClientEMS | affected 06.02.00 06.02.02 semver | Not specified |
| CNA | Fortinet | FortiClientEMS | affected 6.0.8 | Not specified |
| CNA | Fortinet | FortiClientEMS | affected 06.00.00 06.00.06 semver | Not specified |
| CNA | Fortinet | FortiClientEMS | affected 01.02.02 01.02.05 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| fortiguard.fortinet.com/psirt/FG-IR-23-362 | [email protected] | fortiguard.fortinet.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Upgrade to FortiClientEMS version 7.4.0 or above Upgrade to FortiClientEMS version 7.2.5 or above
There are currently no legacy QID mappings associated with this CVE.