The vulnerability of the Fortinet FortiClient Enterprise Management Server (EMS) server lies in the incorrect path limitation for the restricted access directory. This allows a malicious actor to perform service denial-of-service attacks, read from or write to a limited number of files.

🗓️ 26 Dec 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

FortiClient EMS path restriction flaw enables denial of service and limited file access.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-21753	10 Sep 202418:25	–	circl
CNNVD	Fortinet FortiClientEMS 路径遍历漏洞	10 Sep 202400:00	–	cnnvd
CVE	CVE-2024-21753	10 Sep 202414:37	–	cve
Cvelist	CVE-2024-21753	10 Sep 202414:37	–	cvelist
EUVD	EUVD-2024-19367	3 Oct 202520:07	–	euvd
Tenable Nessus	Fortinet FortiClient EMS < 7.2.5 (FG-IR-23-362)	13 Sep 202400:00	–	nessus
NVD	CVE-2024-21753	10 Sep 202415:15	–	nvd
OSV	CVE-2024-21753	10 Sep 202415:15	–	osv
Positive Technologies	PT-2024-9822 · Fortinet · Forticlientems	10 Sep 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-21753	23 May 202510:32	–	redhatcve

Vulners

Node

fortinet forticlientemsMatch6.0

OR

fortinet forticlientemsRange1.2.2–1.2.5

OR

fortinet forticlientemsMatch6.4

OR

fortinet forticlientemsMatch6.2

OR

fortinet forticlientemsRange7.2.0–7.2.4

OR

fortinet forticlientemsMatch7.0

Source	Link
fortiguard	www.fortiguard.fortinet.com/psirt/FG-IR-23-362
vuldb	www.vuldb.com/
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2024091086
web	www.web.nvd.nist.gov/view/vuln/detail
fortiguard	www.fortiguard.com/psirt/FG-IR-23-362

26 Dec 2024 00:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 36

CVSS 28

EPSS0.00741

FortiClient enterprise management path restriction flaw denial of service limited file access crafted requests