Fortinet FortiClientEMS: Mehrere Schwachstellen ermöglichen Codeausführung

Summary

Product

Vulnerabilities 2

• Critical 9.3
  CVE-2023-48788 Exploited · Ransomware Public exploit Scanner template EPSS 98%

  A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS versi…

  Fortinet FortiClientEMS Network devices
  Mar 12, 2024

  KEV Mar 25, 2024
• High 8.7
  CVE-2023-47534

  A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.…

  Fortinet FortiClientEMS Network devices
  Mar 12, 2024

Revision history

1. 2024-12-18 #3

   CVE-2023-48788 wird ausgenutzt

2. 2024-03-21 #2

   PoC für CVE-2023-48788 aufgenommen

3. 2024-03-12 #1

   Initiale Fassung

References

• Fortinet Security Advisory vom 2024-03-12
  https://fortiguard.fortinet.com/psirt/FG-IR-23-390
• Fortinet Security Advisory vom 2024-03-12
  https://fortiguard.fortinet.com/psirt/FG-IR-24-007
• PoC CVE-2023-48788 vom 2024-03-21
  https://github.com/horizon3ai/CVE-2023-48788
• Kaspersky Securelist vom 2024-12-18
  https://securelist.com/patched-forticlient-ems-vulnerability-exploited-in-the-wild/115046/