Vulnerabilities > CVE-2021-24016 - Improper Neutralization of Formula Elements in a CSV File vulnerability in Fortinet Fortimanager

CVSS 6.3 - MEDIUM

Attack vector

LOCAL

Attack complexity

HIGH

Privileges required

HIGH

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

high complexity

fortinet

CWE-1236

NVD

Published: 2021-09-30

Updated: 2021-10-08

Summary

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host.

Vulnerable Configurations

Part	Description	Count
Application	Fortinet Fortinet Fortimanager - Fortinet Fortimanager 4.0.0 Fortinet Fortimanager 4.0.1 Fortinet Fortimanager 4.0.2 Fortinet Fortimanager 4.0.3 Fortinet Fortimanager 4.1.0 Fortinet Fortimanager 4.2.0 Fortinet Fortimanager 4.2.1 Fortinet Fortimanager 4.2.2 Fortinet Fortimanager 4.2.3 Fortinet Fortimanager 4.2.4 Fortinet Fortimanager 4.2.5 Fortinet Fortimanager 4.2.6 Fortinet Fortimanager 4.2.7 Fortinet Fortimanager 4.2.8 Fortinet Fortimanager 4.2.9 Fortinet Fortimanager 4.3.0 Fortinet Fortimanager 4.3.1 Fortinet Fortimanager 4.3.2 Fortinet Fortimanager 4.3.3 Fortinet Fortimanager 4.3.4 Fortinet Fortimanager 4.3.5 Fortinet Fortimanager 4.3.6 Fortinet Fortimanager 4.3.7 Fortinet Fortimanager 4.3.8 Fortinet Fortimanager 5.0.0 Fortinet Fortimanager 5.0.1 Fortinet Fortimanager 5.0.2 Fortinet Fortimanager 5.0.3 Fortinet Fortimanager 5.0.4 Fortinet Fortimanager 5.0.5 Fortinet Fortimanager 5.0.6 Fortinet Fortimanager 5.0.7 Fortinet Fortimanager 5.0.8 Fortinet Fortimanager 5.0.9 Fortinet Fortimanager 5.0.10 Fortinet Fortimanager 5.0.11 Fortinet Fortimanager 5.0.12 Fortinet Fortimanager 5.2.0 Fortinet Fortimanager 5.2.1 Fortinet Fortimanager 5.2.2 Fortinet Fortimanager 5.2.3 Fortinet Fortimanager 5.2.4 Fortinet Fortimanager 5.2.6 Fortinet Fortimanager 5.2.7 Fortinet Fortimanager 5.2.9 Fortinet Fortimanager 5.2.10 Fortinet Fortimanager 5.4.0 Fortinet Fortimanager 5.4.1 Fortinet Fortimanager 5.4.2 Fortinet Fortimanager 5.4.3 Fortinet Fortimanager 5.4.4 Fortinet Fortimanager 5.4.5 Fortinet Fortimanager 5.4.6 Fortinet Fortimanager 5.4.7 Fortinet Fortimanager 5.6.0 Fortinet Fortimanager 5.6.1 Fortinet Fortimanager 5.6.2 Fortinet Fortimanager 5.6.3 Fortinet Fortimanager 5.6.4 Fortinet Fortimanager 5.6.5 Fortinet Fortimanager 5.6.6 Fortinet Fortimanager 5.6.7 Fortinet Fortimanager 5.6.8 Fortinet Fortimanager 5.6.9 Fortinet Fortimanager 5.6.10 Fortinet Fortimanager 5.6.11 Fortinet Fortimanager 6.0.0 Fortinet Fortimanager 6.0.1 Fortinet Fortimanager 6.0.2 Fortinet Fortimanager 6.0.3 Fortinet Fortimanager 6.0.4 Fortinet Fortimanager 6.0.5 Fortinet Fortimanager 6.0.6 Fortinet Fortimanager 6.0.7 Fortinet Fortimanager 6.0.8 Fortinet Fortimanager 6.0.9 Fortinet Fortimanager 6.0.10 Fortinet Fortimanager 6.0.11 Fortinet Fortimanager 6.2.0 Fortinet Fortimanager 6.2.1 Fortinet Fortimanager 6.2.2 Fortinet Fortimanager 6.2.3 Fortinet Fortimanager 6.2.4 Fortinet Fortimanager 6.2.5 Fortinet Fortimanager 6.2.6 Fortinet Fortimanager 6.2.7 Fortinet Fortimanager 6.4.0 Fortinet Fortimanager 6.4.1 Fortinet Fortimanager 6.4.2 Fortinet Fortimanager 6.4.3	92

Common Weakness Enumeration (CWE)

CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

References

https://fortiguard.com/advisory/FG-IR-20-190