CVE-2021-24016low

CVE-2021-24016: low-severity vulnerability in Fortinet FortiManager

Published · Updated

Follow this CVE+ Monitor FortiManager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.7epss 0.5%
An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host.
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:X
Affected products
Fortinet · Fortinet FortiManager
Related CVEs — Fortinet FortiManager

In the same product, most dangerous first.

CVE-2021-24006MEDIUMCVE-2021-24006EPSS 1.0%CVE-2021-24017MEDIUMCVE-2021-24017EPSS 0.6%CVE-2021-26107MEDIUMCVE-2021-26107EPSS 0.5%CVE-2019-17654—CVE-2019-17654EPSS 0.5%CVE-2021-36192MEDIUMCVE-2021-36192EPSS 0.2%CVE-2022-22303LOWCVE-2022-22303EPSS 0.2%