CVE-2023-47534

Published: Mar 12, 2024Modified: Oct 22, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.0 through 7.0.10, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions allows attacker to execute unauthorized code or commands via specially crafted packets.

Affected (5)

Products: Fortinet: Forticlient Endpoint Management Server

Fortinet

1 product

Forticlient Endpoint Management Server

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Fortinet Forticlient Endpoint Management Server	6.0.0 ≤ version ≤ 6.0.8
Fortinet Forticlient Endpoint Management Server	6.2.0 ≤ version ≤ 6.2.9
Fortinet Forticlient Endpoint Management Server	6.4.0 ≤ version ≤ 6.4.9
Fortinet Forticlient Endpoint Management Server	7.0.0 ≤ version ≤ 7.0.10
Fortinet Forticlient Endpoint Management Server	7.2.0 ≤ version ≤ 7.2.2

Related CWEs

CWE-1236

Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

References (2)

https://fortiguard.com/psirt/FG-IR-23-390

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-23-390

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.