medium4.3Known exploited
CVE-2018-13383
Fortinet FortiOS and FortiProxy Out-of-bounds Write
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-01-10. Federal due date: 2022-07-10.
Apply updates per vendor instructions.
Impact
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fortinet | Fortiproxy | before 1.2.9 Version 2.0.0 |
| Fortinet | Fortios | from 5.2.0 before 5.2.15 from 5.4.0 before 5.4.13 from 5.6.0 before 5.6.11 from 6.0.0 before 6.0.5 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://fortiguard.com/advisory/FG-IR-18-388
- https://fortiguard.com/advisory/FG-IR-20-229
- https://fortiguard.com/advisory/FG-IR-18-388
- https://fortiguard.com/advisory/FG-IR-20-229
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13383