Actively exploited · Published Mar 12, 2024 · Assigned by fortinet
CVE-2023-48788
Critical 9.3 Exploited Ransomware
In plain English
A critical-severity SQL injection in FortiClientEMS from Fortinet. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2024). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 98.4% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Apr 15, 2024.
Official description
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiClientEMS | 7.2.0 – through 7.2.27.0.1 – through 7.0.10 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C