Fortinet FortiClient Endpoint Management Server vulnerabilities

6 CVEs affecting Fortinet FortiClient Endpoint Management Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-21753, published 2024-09-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-24019, published 2021-10-06. Critical severity, CVSS 9.8. EPSS: 3.9% chance of exploitation in the next 30 days. An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user session IDs to gain…
CVE-2020-15941, published 2021-10-06. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A path traversal vulnerability [CWE-22] in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authenticated attacker to inject directory traversal character sequences to add/delete…
CVE-2023-47534, published 2024-03-12. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8…
CVE-2021-44172, published 2023-09-13. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in all 6.4 and 6.2 version management…
CVE-2024-21753, published 2024-09-10. Medium severity, CVSS 6.0. EPSS: 0.7% chance of exploitation in the next 30 days. A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13, 6.4.0 through 6.4.9, 6.2.0 through…
CVE-2021-41028, published 2021-12-16. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an improper certificate validation vulnerability [CWE-297] in…