CVE-2023-47534: A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.0 through 7.0.10, FortiClientEMS 6.4…

High severity · published Mar 12, 2024

CVE-2023-47534

A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.0 through 7.0.10, FortiClientEMS 6.4…

8.8

CVSS

1.1%

EPSS

On KEV

Description

A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.0 through 7.0.10, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions allows attacker to execute unauthorized code or commands via specially crafted packets.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.1% · higher than 64% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

FortiClientEMS · Fortinet

7.2.0 through 7.2.2; 7.0.0 through 7.0.10; 6.4.7 through 6.4.9; 6.4.0 through 6.4.4; 6.2.6 through 6.2.9; 6.2.3 through 6.2.4; +3 more · source: vendor

Forticlient Endpoint Management Server · Fortinet

6.0.0 through 6.0.8; 6.2.0 through 6.2.9; 6.4.0 through 6.4.9; 7.0.0 through 7.0.10; 7.2.0 through 7.2.2 · source: NVD, CISA

Affected product

FortiClientEMS

Fortinet

All FortiClientEMS CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-47534

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-47534

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-23-390