« Volver al listado

CVE-2021-44172

Estado: ModificadaMedia (5.3)—

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in all 6.4 and 6.2 version management interface may allow an unauthenticated attacker to gain information on environment variables such as the EMS installation path.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fortinet — Forticlient Endpoint Management Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-44172",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-44172",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-24T19:39:59.818505Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "FortiClientEMS",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.7"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.4"
            },
            {
              "status": "affected",
              "version": "6.4.7",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.9"
            },
            {
              "status": "affected",
              "version": "6.4.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.4"
            },
            {
              "status": "affected",
              "version": "6.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.9"
            },
            {
              "status": "affected",
              "version": "6.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.4"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-09-13T13:15:07.537",
  "references": [
    {
      "url": "https://fortiguard.com/psirt/FG-IR-21-244",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/psirt/FG-IR-21-244",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@fortinet.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in all 6.4 and 6.2 version management interface may allow an unauthenticated attacker to gain information on environment variables such as the EMS installation path."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de exposición de información sensible a un actor no autorizado [CWE-200] en FortiClientEMS versiones 7.0.0 a 7.0.4, 7.0.6 a 7.0.7, en todas las versiones de interfaz de administración 6.4 y 6.2 puede permitir que un atacante no autenticado obtenga información en variables de entorno como la ruta de instalación de EMS"
    }
  ],
  "lastModified": "2026-06-17T04:11:59.773",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D16D1BDE-ED3A-472B-AE5D-9A22B330AD82",
              "versionEndIncluding": "6.2.9",
              "versionStartIncluding": "6.2.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4FE4D98-C047-4A51-BFD2-99ADB9C18BCD",
              "versionEndIncluding": "6.4.9",
              "versionStartIncluding": "6.4.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80967C38-4E85-4E88-B471-D17622C7F723",
              "versionEndIncluding": "7.0.4",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "699A4FFF-6CEB-497C-9423-5FAD6C2989C3",
              "versionEndIncluding": "7.0.7",
              "versionStartIncluding": "7.0.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}