CVE-2023-47534

Published: Mar 12, 2024Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8 allows attacker to execute unauthorized code or commands via specially crafted packets.

Affected (5)

Products: Fortinet: Forticlient Endpoint Management Server

Fortinet

1 product

Forticlient Endpoint Management Server

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Fortinet Forticlient Endpoint Management Server	From 6.0.0 to 6.0.8
Fortinet Forticlient Endpoint Management Server	From 6.2.0 to 6.2.9
Fortinet Forticlient Endpoint Management Server	From 6.4.0 to 6.4.9
Fortinet Forticlient Endpoint Management Server	From 7.0.0 to 7.0.10
Fortinet Forticlient Endpoint Management Server	From 7.2.0 to 7.2.2

Related CWEs

CWE-1236

Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

References (2)

https://fortiguard.com/psirt/FG-IR-23-390

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-23-390

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.