Sensitive Information Exposure in FortiClientEMS Product by Fortinet
CVE-2021-44172

3.6LOW

Key Information:

Vendor

Fortinet
Status
Forticlientems
Vendor
CVE Published:
13 September 2023

What is CVE-2021-44172?

A vulnerability exists in FortiClientEMS management interface versions 7.0.0 to 7.0.4, 7.0.6 to 7.0.7, and all 6.4 and 6.2 versions that allows unauthorized access. This flaw could potentially allow an unauthenticated attacker to retrieve sensitive information such as the EMS installation path and other environment variables, thereby compromising system integrity. Users are recommended to update to the latest versions and secure their deployments.

Affected Version(s)

FortiClientEMS 7.0.6 <= 7.0.7

FortiClientEMS 7.0.0 <= 7.0.4

FortiClientEMS 6.4.7 <= 6.4.9

References

https://fortiguard.com/psirt/FG-IR-21-244

CVSS V3.1

Score:
3.6
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.