What is CVE-2023-48788?

A critical vulnerability, CVE-2023-48788, has been identified in certain versions of Fortinet FortiClientEMS software. This vulnerability, known as an SQL injection, allows attackers to execute unauthorized code or commands through specially crafted packets. Systems running affected versions of Fortinet FortiClientEMS are at risk, and it is crucial for organizations to take appropriate measures to mitigate this security threat.

Who is impacted?

The CVE-2023-48788 vulnerability affects users of Fortinet FortiClientEMS software, specifically those running versions 7.2.0 to 7.2.2 and 7.0.1 to 7.0.10. This security issue, known as an SQL injection, allows attackers to execute unauthorized code or commands through specially crafted packets, putting systems running these affected versions at risk.

What to do if CVE-2023-48788 affected you

If you're affected by the CVE-2023-48788 vulnerability, it's important to take action to protect your systems. Follow these steps to mitigate the risk:

1. Upgrade FortiClientEMS 7.2 to version 7.2.3 or above

2. Upgrade FortiClientEMS 7.0 to version 7.0.11 or above

3. Apply the virtual patch "FG-VD-54509.0day:FortiClientEMS.DAS.SQL.Injection" available in FMWP db update 27.750, if applicable

Remember to prioritize addressing known exploited vulnerabilities and follow vendor recommendations to keep your systems secure.

Is it in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-48788 vulnerability, also known as the Fortinet FortiClient EMS SQL Injection Vulnerability, is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. It was added on March 25, 2024, and the due date for required action is April 15, 2024. Organizations must apply mitigations as per vendor instructions or discontinue using the affected product if no mitigations are available.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-89, which involves SQL injection in Fortinet FortiClientEMS software.

Learn More

CVE-2023-48788 highlights the importance of addressing known exploited vulnerabilities and following vendor recommendations to secure systems. For a comprehensive understanding of this vulnerability, consult the NVD page and the sources listed below.

• PSIRT | FortiGuard Labs

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

• Known Exploited Vulnerabilities Catalog