critical9.1Known exploitedPublic exploit code
CVE-2018-13382
Fortinet FortiOS and FortiProxy Improper Authorization
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-01-10. Federal due date: 2022-07-10.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Fortinet FortiOS 6.0.4 - Unauthenticated SSL VPN User Password Modification2020-11-19 · webapps · hardware
Impact
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fortinet | Fortiproxy | before 1.2.9 Version 2.0.0 |
| Fortinet | Fortios | from 5.4.1 before 5.4.11 from 5.6.0 before 5.6.9 from 6.0.0 before 6.0.5 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://fortiguard.com/advisory/FG-IR-18-389
- https://www.fortiguard.com/psirt/FG-IR-20-231
- https://fortiguard.com/advisory/FG-IR-18-389
- https://www.fortiguard.com/psirt/FG-IR-20-231
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382