CVE-2024-21753

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21753
A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8, 1.2.1 through 1.2.5 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests

6.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://fortiguard.fortinet.com/psirt/FG-IR-23-362 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*
History

25 Sep 2024, 18:36

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.5 		v2 : unknown
v3 : 6.0
First Time Fortinet
Fortinet forticlient Endpoint Management Server
CPE cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*
References () https://fortiguard.fortinet.com/psirt/FG-IR-23-362 - () https://fortiguard.fortinet.com/psirt/FG-IR-23-362 - Vendor Advisory
Summary
  • (es) Una limitación incorrecta de una ruta de acceso a un directorio restringido ("ruta de acceso") en las versiones 7.2.0 a 7.2.4, 7.0.0 a 7.0.13, 6.4.0 a 6.4.9, 6.2.0 a 6.2.9, 6.0.0 a 6.0.8, 1.2.1 a 1.2.5 de Fortinet FortiClientEMS permite a un atacante realizar una denegación de servicio, leer o escribir una cantidad limitada de archivos a través de solicitudes HTTP especialmente manipuladas.

10 Sep 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-10 15:15

Updated : 2024-09-25 18:36

NVD link : CVE-2024-21753

Mitre link : CVE-2024-21753

CVE.ORG link : CVE-2024-21753

JSON object : View

Products Affected

fortinet

  • forticlient_endpoint_management_server
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')