CVE-2023-25611: CSV injection in macro name
A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 - 7.2.1 allows local attacker to execute unauthorized code or commands via inserting spreadsheet formulas in macro names.
Other sources
An improper neutralization of formula elements vulnerability (CWE 1236) in FortiAnalyzer may allow a local authenticated privileged attacker to execute arbitrary code on the end-user's host via inserting spreadsheet formulas in the macro names. This is achieved once the user downloads and opens the CSV report files.
— FortiGuard
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-25611.
What is the severity of CVE-2023-25611?
The severity of CVE-2023-25611 is high with a severity value of 7.3.
Which software versions are affected by CVE-2023-25611?
Fortinet FortiAnalyzer versions 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 - 7.2.1 are affected by CVE-2023-25611.
How can a local attacker exploit CVE-2023-25611?
A local attacker can exploit CVE-2023-25611 by inserting spreadsheet formulas in macro names in a CSV file, allowing them to execute unauthorized code or commands.
How can I fix CVE-2023-25611?
Update your Fortinet FortiAnalyzer to versions 7.0.6 or newer for versions 6.4.0 - 6.4.9, or to versions 7.2.2 or newer for versions 7.0.0 - 7.0.5 and 7.2.0 - 7.2.1.