CVE-2018-13382

Fortinet FortiOS, FortiProxy

Published 4 Jun 2019 · updated 17 Jun 2026 · Analyzed

7.5 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 10 Jan 2022, with a remediation deadline of 10 Jul 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests

References

fortiguard.com/advisory/FG-IR-18-389 · Vendor Advisory
www.fortiguard.com/psirt/FG-IR-20-231 · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382 · US Government Resource