CVE-2021-24016

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute…

Low · published September 30, 2021

CVSS v3.1
3.7
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:X
CVSS v4.0
Not supplied
EPSS
0.00504 · 42.2th percentile
Published
2021-09-30T15:18Z
EPSS history
Timeline
  • 30 SEP 15:18Z
    An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute…
    cvelistv5