CVE-2024-21753

State: Published
Severity: 5.5 Medium
Published: Sep 10, 2024
Updated: Oct 22, 2026
Reserved: Jan 2, 2024

Description

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.4, FortiClientEMS 7.0 all versions, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions, FortiClientEMS 01.02.02 through 01.02.05 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:H/RL:U/RC:C	fortinet

Weaknesses

CWE-22 Denial of service

Affected Products

Product	Versions
FortiClientEMSFortinet	7.2.0 through 7.2.4Affected 7.0.0 through 7.0.13Affected 6.4.7 through 6.4.9Affected 6.4.0 through 6.4.4Affected 6.2.6 through 6.2.9Affected 6.2.3 through 6.2.4Affected 06.02.00 through 06.02.02Affected 6.0.8Affected 06.00.00 through 06.00.06Affected 01.02.02 through 01.02.05Affected

References

https://fortiguard.fortinet.com/psirt/FG-IR-23-362

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.