9.1
Critical
Exploited
· ransomware
CVE-2018-13379 Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Known to be used
Weakness
CWE-22
Description
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fortinet FortiOS, FortiProxy | Versions not published |
References
- fortiguard.com fortiguard.com
- www.fortiguard.com www.fortiguard.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Fortinet FortiOS, FortiProxy
The 6 CVEs of Fortinet FortiOS, FortiProxy →
CVE-2022-29055
A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0…
7.5
High
CVE-2021-43206
A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through…
4.3
Medium
CVE-2021-26092
Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0…
4.7
Medium
CVE-2021-26110
An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below,…
7.8
High