medium4.3Known exploitedPublic exploit code
CVE-2018-13374
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-09-08. Federal due date: 2022-09-29.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Fortinet FortiGate FortiOS < 6.0.3 - LDAP Credential Disclosure2019-01-16 · webapps · hardware · Verified
Impact
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fortinet | Fortiadc | from 5.4.0 before 5.4.5 from 6.0.0 before 6.0.2 Version 6.1.0 |
| Fortinet | Fortios | before 6.0.3 |