CVE-2024-21753

Name of the Vulnerable Software and Affected Versions: Fortinet FortiClientEMS versions 1.2.1 through 1.2.5 Fortinet FortiClientEMS versions 6.0.0 through 6.0.8 Fortinet FortiClientEMS versions 6.2.0 through 6.2.9 Fortinet FortiClientEMS versions 6.4.0 through 6.4.9 Fortinet FortiClientEMS versions 7.0.0 through 7.0.13 Fortinet FortiClientEMS versions 7.2.0 through 7.2.4

Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'path traversal', in Fortinet FortiClientEMS. This allows an attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests.

Recommendations: For Fortinet FortiClientEMS versions 1.2.1 through 1.2.5, update to a version that fixes the path traversal issue. For Fortinet FortiClientEMS versions 6.0.0 through 6.0.8, update to a version that fixes the path traversal issue. For Fortinet FortiClientEMS versions 6.2.0 through 6.2.9, update to a version that fixes the path traversal issue. For Fortinet FortiClientEMS versions 6.4.0 through 6.4.9, update to a version that fixes the path traversal issue. For Fortinet FortiClientEMS versions 7.0.0 through 7.0.13, update to a version that fixes the path traversal issue. For Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, update to a version that fixes the path traversal issue. As a temporary workaround, consider restricting access to the vulnerable HTTP endpoints until a patch is available.