CVE-2023-47534

2024-03-1215:15:46

CWE-1236

[email protected]

web.nvd.nist.gov

cve-2023-47534

fortinet

forticlientems

security vulnerability

code execution

csv

packet crafting

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:R

9.3 High

AI Score

Confidence

High

JSON

A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8 allows attacker to execute unauthorized code or commands via specially crafted packets.

CPE configuration

NVD

fortinetforticlient_endpoint_management_serverRange6.0.0–6.0.8

fortinetforticlient_endpoint_management_serverRange6.2.0–6.2.9

fortinetforticlient_endpoint_management_serverRange6.4.0–6.4.9

fortinetforticlient_endpoint_management_serverRange7.0.0–7.0.10

fortinetforticlient_endpoint_management_serverRange7.2.0–7.2.2

CPENameOperatorVersion
fortinet:forticlient_endpoint_management_serverfortinet forticlient endpoint management serverle6.0.8
fortinet:forticlient_endpoint_management_serverfortinet forticlient endpoint management serverle6.2.9
fortinet:forticlient_endpoint_management_serverfortinet forticlient endpoint management serverle6.4.9
fortinet:forticlient_endpoint_management_serverfortinet forticlient endpoint management serverle7.0.10
fortinet:forticlient_endpoint_management_serverfortinet forticlient endpoint management serverle7.2.2

CPE	Name	Operator	Version
fortinet:forticlient_endpoint_management_server	fortinet forticlient endpoint management server	le	6.0.8
fortinet:forticlient_endpoint_management_server	fortinet forticlient endpoint management server	le	6.2.9
fortinet:forticlient_endpoint_management_server	fortinet forticlient endpoint management server	le	6.4.9
fortinet:forticlient_endpoint_management_server	fortinet forticlient endpoint management server	le	7.0.10
fortinet:forticlient_endpoint_management_server	fortinet forticlient endpoint management server	le	7.2.2

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiClientEMS",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.10",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.7",
        "lessThanOrEqual": "6.4.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.6",
        "lessThanOrEqual": "6.2.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.4",
        "status": "affected"
      },
      {
        "version": "6.0.8",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.6",
        "status": "affected"
      }
    ]
  }
]