Detections
Analytics

Fortinet FortiClient EMS < 7.2.5 (FG-IR-23-362)

medium Nessus Plugin ID 207234

Synopsis

The remote host is missing a security update.

Description

The version of Fortinet FortiClient EMS installed on the remote host is prior to 7.2.5. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-362 advisory.

 - A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8, 1.2.1 through 1.2.5 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Fortinet FortiClient EMS version 7.2.5 or later.

See Also

https://fortiguard.fortinet.com/psirt/FG-IR-23-362

Plugin Details

Severity: Medium

ID: 207234

File Name: fortinet_forticlient_ems_FG-IR-23-362.nasl

Version: 1.1

Type: local

Agent: windows

Family: Windows

Published: 9/13/2024

Updated: 9/13/2024

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:M/C:N/I:P/A:C

CVSS Score Source: CVE-2024-21753

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Vulnerability Information

CPE: cpe:/a:fortinet:forticlient_enterprise_management_server

Required KB Items: installed_sw/Fortinet FortiClient EMS

Patch Publication Date: 9/10/2024

Vulnerability Publication Date: 9/10/2024

Reference Information

CVE: CVE-2024-21753

IAVA: 2024-A-0572