4.3
Medium
CVE-2018-13374 Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Known to be used
Weakness
CWE-732
Description
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fortinet FortiOS, fortiADC | Versions not published |