CVE-2024-21753
Full vulnerability record from the local CVENow database.
Description
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.4, FortiClientEMS 7.0 all versions, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions, FortiClientEMS 01.02.02 through 01.02.05 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests
Severity
MEDIUM
CVSS score
6.0
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2024-09-10 15:15:14.543000
Last modified
2026-10-22 14:17:34.197000
View original CVE JSON
{
"id": "CVE-2024-21753",
"sourceIdentifier": "[email protected]",
"published": "2024-09-10T15:15:14.543",
"lastModified": "2026-10-22T14:17:34.197",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.4, FortiClientEMS 7.0 all versions, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions, FortiClientEMS 01.02.02 through 01.02.05 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests"
},
{
"lang": "es",
"value": "Una limitación incorrecta de una ruta de acceso a un directorio restringido (\"ruta de acceso\") en las versiones 7.2.0 a 7.2.4, 7.0.0 a 7.0.13, 6.4.0 a 6.4.9, 6.2.0 a 6.2.9, 6.0.0 a 6.0.8, 1.2.1 a 1.2.5 de Fortinet FortiClientEMS permite a un atacante realizar una denegación de servicio, leer o escribir una cantidad limitada de archivos a través de solicitudes HTTP especialmente manipuladas."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Fortinet",
"product": "FortiClientEMS",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:forticlientems:7.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.13:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.12:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.11:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.2.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.2.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.2.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:06.02.02:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:06.02.01:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:06.02.00:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.0.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:06.00.06:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:06.00.05:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:06.00.04:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:06.00.03:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:06.00.02:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:06.00.01:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:06.00.00:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:01.02.05:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:01.02.04:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:01.02.03:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:01.02.02:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.2.3:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.2.0",
"lessThanOrEqual": "7.2.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.0.0",
"lessThanOrEqual": "7.0.13",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.4.7",
"lessThanOrEqual": "6.4.9",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.4.0",
"lessThanOrEqual": "6.4.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.2.6",
"lessThanOrEqual": "6.2.9",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.2.3",
"lessThanOrEqual": "6.2.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "06.02.00",
"lessThanOrEqual": "06.02.02",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.0.8",
"status": "affected"
},
{
"version": "06.00.00",
"lessThanOrEqual": "06.00.06",
"versionType": "semver",
"status": "affected"
},
{
"version": "01.02.02",
"lessThanOrEqual": "01.02.05",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 4.2
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H",
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 4.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2024-09-10T18:58:21.335420Z",
"id": "CVE-2024-21753",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.2.1",
"versionEndIncluding": "1.2.5",
"matchCriteriaId": "80E99ECA-E06D-4361-8592-B06D1534F62D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.0",
"versionEndIncluding": "6.0.8",
"matchCriteriaId": "AEDE19DC-94DB-4BEB-8439-C2BE06EF0625"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2.0",
"versionEndIncluding": "6.2.9",
"matchCriteriaId": "D16D1BDE-ED3A-472B-AE5D-9A22B330AD82"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.0",
"versionEndIncluding": "6.4.9",
"matchCriteriaId": "C4FE4D98-C047-4A51-BFD2-99ADB9C18BCD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.0",
"versionEndIncluding": "7.0.13",
"matchCriteriaId": "5F76A5C6-0B7E-4E3F-B6DF-4F2607B3D0FF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.2.0",
"versionEndIncluding": "7.2.4",
"matchCriteriaId": "4CE97B00-1C8A-4B71-9FB3-76AAD0B3EACC"
}
]
}
]
}
],
"references": [
{
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-362",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}