Vulnerabilities > CVE-2021-24016 - Improper Neutralization of Formula Elements in a CSV File vulnerability in Fortinet Fortimanager

CVSS 9.3 - CRITICAL

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

fortinet

CWE-1236

critical

NVD

Published: 2021-09-30

Updated: 2021-10-08

Summary

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host.

Vulnerable Configurations

Part	Description	Count
Application	Fortinet Fortinet Fortimanager 4.0.0 Fortinet Fortimanager 4.0.1 Fortinet Fortimanager 4.0.2 Fortinet Fortimanager 4.0.3 Fortinet Fortimanager 4.1.0 Fortinet Fortimanager 4.2.0 Fortinet Fortimanager 4.2.1 Fortinet Fortimanager 4.2.2 Fortinet Fortimanager 4.2.3 Fortinet Fortimanager 4.2.4 Fortinet Fortimanager 4.2.5 Fortinet Fortimanager 4.2.6 Fortinet Fortimanager 4.2.7 Fortinet Fortimanager 4.2.8 Fortinet Fortimanager 4.2.9 Fortinet Fortimanager 4.3.0 Fortinet Fortimanager 4.3.1 Fortinet Fortimanager 4.3.2 Fortinet Fortimanager 4.3.3 Fortinet Fortimanager 4.3.4 Fortinet Fortimanager 4.3.5 Fortinet Fortimanager 4.3.6 Fortinet Fortimanager 4.3.7 Fortinet Fortimanager 4.3.8 Fortinet Fortimanager 5.0.0 Fortinet Fortimanager 5.0.1 Fortinet Fortimanager 5.0.2 Fortinet Fortimanager 5.0.3 Fortinet Fortimanager 5.0.4 Fortinet Fortimanager 5.0.5 Fortinet Fortimanager 5.0.6 Fortinet Fortimanager 5.0.7 Fortinet Fortimanager 5.0.8 Fortinet Fortimanager 5.0.9 Fortinet Fortimanager 5.0.10 Fortinet Fortimanager 5.0.11 Fortinet Fortimanager 5.0.12 Fortinet Fortimanager 5.2.0 Fortinet Fortimanager 5.2.1 Fortinet Fortimanager 5.2.2 Fortinet Fortimanager 5.2.3 Fortinet Fortimanager 5.2.4 Fortinet Fortimanager 5.2.6 Fortinet Fortimanager 5.2.7 Fortinet Fortimanager 5.2.9 Fortinet Fortimanager 5.2.10 Fortinet Fortimanager 5.4.0 Fortinet Fortimanager 5.4.1 Fortinet Fortimanager 5.4.2 Fortinet Fortimanager 5.4.3 Fortinet Fortimanager 5.4.4 Fortinet Fortimanager 5.4.5 Fortinet Fortimanager 5.4.6 Fortinet Fortimanager 5.4.7 Fortinet Fortimanager 5.6.0 Fortinet Fortimanager 5.6.1 Fortinet Fortimanager 5.6.2 Fortinet Fortimanager 5.6.3 Fortinet Fortimanager 5.6.4 Fortinet Fortimanager 5.6.5 Fortinet Fortimanager 5.6.6 Fortinet Fortimanager 5.6.7 Fortinet Fortimanager 5.6.8 Fortinet Fortimanager 5.6.9 Fortinet Fortimanager 5.6.10 Fortinet Fortimanager 6.0.0 Fortinet Fortimanager 6.0.1 Fortinet Fortimanager 6.0.2 Fortinet Fortimanager 6.0.3 Fortinet Fortimanager 6.0.4 Fortinet Fortimanager 6.0.5 Fortinet Fortimanager 6.0.6 Fortinet Fortimanager 6.0.7 Fortinet Fortimanager 6.0.8 Fortinet Fortimanager 6.2.0 Fortinet Fortimanager 6.2.1 Fortinet Fortimanager 6.2.2 Fortinet Fortimanager 6.2.3 Fortinet Fortimanager 6.2.4 Fortinet Fortimanager 6.2.5 Fortinet Fortimanager 6.2.6 Fortinet Fortimanager 6.2.7 Fortinet Fortimanager 6.4.0 Fortinet Fortimanager 6.4.1 Fortinet Fortimanager 6.4.2 Fortinet Fortimanager 6.4.3	87

Common Weakness Enumeration (CWE)

CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

References

https://fortiguard.com/advisory/FG-IR-20-190