CVE-2024-21753

Severity: medium (CVSS 6.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-10 · updated 2026-10-22
Weakness: CWE-22

Description

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.4, FortiClientEMS 7.0 all versions, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions, FortiClientEMS 01.02.02 through 01.02.05 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests

Affected products

Fortinet FortiClient EMS: from 1.2.1 through 1.2.5; from 6.0.0 through 6.0.8; from 6.2.0 through 6.2.9; from 6.4.0 through 6.4.9; from 7.0.0 through 7.0.13; from 7.2.0 through 7.2.4

References

https://fortiguard.fortinet.com/psirt/FG-IR-23-362

Get alerted when CVE-2024-21753 or the next vulnerability affects your stack