CVE-2020-15941

Name of the Vulnerable Software and Affected Versions FortiClientEMS versions 6.4.1 and below FortiClientEMS versions 6.2.8 and below

Description A path traversal issue in FortiClientEMS may allow an authenticated attacker to inject directory traversal character sequences, enabling them to add or delete server files via the name parameter of Deployment Packages.

Recommendations For FortiClientEMS versions 6.4.1 and below, update to a version above 6.4.1 to resolve the issue. For FortiClientEMS versions 6.2.8 and below, update to a version above 6.2.8 to resolve the issue. As a temporary workaround, consider restricting access to the name parameter of Deployment Packages to minimize the risk of exploitation.