PSIRTFortiAIOps - CSV Injection in export device inventory feature
Summary
An improper neutralization of formula elements in a CSV File vulnerability [CWE-1236] in FortiAIOps may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV reports.
| Version | Affected | Solution |
|---|---|---|
| FortiAIOps 2.0 | 2.0.0 | Upgrade to 2.0.1 or above |
| FortiAIOps 1.1 | Not affected | Not Applicable |
| FortiAIOps 1.0 | Not affected | Not Applicable |