description: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in all 6.4 and 6.2 version management interface may allow an unauthenticated attacker to gain information on environment variables such as the EMS installation path.
problem types: Information disclosure
affected:
{
vendor: Fortinet
product: FortiClientEMS
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.6, lessThanOrEqual: 7.0.7, status: affected
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.4, status: affected
versionType: semver, version: 6.4.7, lessThanOrEqual: 6.4.9, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.4, status: affected
versionType: semver, version: 6.2.6, lessThanOrEqual: 6.2.9, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.4, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 3.6
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:U
]
solutions: Please upgrade to FortiClientEMS version 7.2.0 or above Please upgrade to FortiClientEMS version 7.0.8 or above