Paper/Archive/CVE-2018-13382

CVE-2018-13382

Fortinet Fortinet FortiOS, FortiProxy — Fortinet FortiOS and FortiProxy Improper Authorization

KEV · due 10 Jul ransomware use EPSS 82%public exploit SSVC act CVSS 9.1

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 In CISA KEV+3030.0 EPSS percentile 99.6.996 × 2019.9 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests

Affected

ProductAffectedFixed inSource

Fortinet FortiOS, FortiProxyFortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, 5.4.1 to 5.4.10, FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7–CNA

Scores by source

fortinet (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

reffortiguard.com/advisory/FG-IR-18-389 reffortiguard.com/psirt/FG-IR-20-231 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382 kevcisa.gov/known-exploited-vulnerabilities-catalog