Medium severity · published Sep 10, 2024
CVE-2024-21753
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.4, FortiClientEMS 7.0 all versions,…
6.0
CVSS
0.8%
EPSS
No
On KEV
Description
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.4, FortiClientEMS 7.0 all versions, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions, FortiClientEMS 01.02.02 through 01.02.05 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
FortiClientEMS · Fortinet
7.2.0 through 7.2.4; 7.0.0 through 7.0.13; 6.4.7 through 6.4.9; 6.4.0 through 6.4.4; 6.2.6 through 6.2.9; 6.2.3 through 6.2.4; +4 more · source: vendor
FE
Forticlient Endpoint Management Server · Fortinet
1.2.1 through 1.2.5; 6.0.0 through 6.0.8; 6.2.0 through 6.2.9; 6.4.0 through 6.4.9; 7.0.0 through 7.0.13; 7.2.0 through 7.2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21753
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21753
Vendor Advisory
https://fortiguard.fortinet.com/psirt/FG-IR-23-362
More from FortiClientEMS
9.8
CVE-2026-35616
Fortinet FortiClient EMS Improper Access Control Vulnerability
9.8
CVE-2026-21643
Fortinet FortiClient EMS SQL Injection Vulnerability
9.8
CVE-2023-48788
Fortinet FortiClient EMS SQL Injection Vulnerability
9.8
CVE-2026-59836
A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow…
9.8
CVE-2024-23106
An improper restriction of excessive authentication attempts [CWE-307] in FortiClientEMS version 7.2.0 through 7.2.4 and before 7.0.10 allows an unauthenticated attacker to try a…