CVE-2024-21753: Denial of service in Fortinet FortiClientEMS

CVE-2024-21753 is an improper limitation of a pathname to a restricted directory (path traversal) vulnerability affecting multiple versions of Fortinet FortiClientEMS. The vulnerability enables an attacker with high privileges to send specially crafted HTTP requests that can cause denial of service or allow reading or writing a limited number of files outside the intended directory scope. The affected versions include FortiClientEMS 7.2.0 through 7.2.4, 7.0.0 through 7.0.13, 6.4.0 through 6.4.9, 6.2.3 through 6.2.9, 06.02.00 through 06.02.02, 06.00.00 through 06.00.06, 01.02.02 through 01.02.05, and version 6.0.8. The vulnerability has a CVSS 3.1 base score of 5.5, indicating medium severity. No official fix or patch has been released as of the publication date.

An attacker with high privileges can exploit this vulnerability to cause denial of service conditions or perform limited unauthorized file read/write operations on affected FortiClientEMS installations. This could disrupt service availability and potentially modify files within the system, impacting integrity. Confidentiality is not impacted according to the CVSS vector. No known active exploitation has been reported.

No official patch or remediation is currently available for this vulnerability. Users should monitor Fortinet advisories for updates. Until a fix is released, restrict access to FortiClientEMS management interfaces to trusted administrators and networks to reduce the risk of exploitation.