Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-24016

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host.

Published

2021-09-30T16:15:07.350

Last Modified

2024-11-21T05:52:12.837

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 3.7 (LOW)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.6

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-1236
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application fortinet fortimanager < 6.2.8 Yes
Application fortinet fortimanager < 6.4.4 Yes
References