Fortinet PSIRT Monthly Advisories — March 2024
Tuesday, 12 March 2024
Exploited 1
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
Critical 9.3
CVE-2023-48788 Exploited Public exploit Scanner template A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7…EPSS 98%
Critical 1
All vulnerabilities 9
Critical2 ShowHide
-
Critical 9.3
CVE-2023-48788 Exploited Public exploit Scanner template A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7…EPSS 98%
-
Critical 9.3
CVE-2023-42789 Public exploit A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6…EPSS 3.3%
High4 ShowHide
-
High 8.7
CVE-2023-47534 A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.0 through 7.0.10, …EPSS 1.1%
- High 7.7
-
High 7.7
CVE-2023-42790 A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 t…EPSS 1.1%
- High 7.2
Medium2 ShowHide
- Medium 6.7
- Medium 6.3