← CVE Radar
CVE-2018-13382Fortinet FortiOS and FortiProxy Improper Authorization
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
9.1 CRITICALEPSS 81.69%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.1 | CRITICAL | 3.1fortinet (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 7.5 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 5.0 | MEDIUM | 2.0NVD | AV:N/AC:L/Au:N/C:N/I:P/A:N |
CISA required action
⚡ Known exploited · remediation due Jul 10, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2018-13382
- Status
- Analyzed
- Assigner (CNA)
- fortinet
- Published
- Jun 4, 2019
- Last modified
- 2026-06-17 01:39 UTC
Affected Products
As published by the CNA in the CVE record.
FortinetFortinet FortiOS, FortiProxy1 version range
- FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, 5.4.1 to 5.4.10, FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7