9.1
Critical
Exploited
· ransomware
CVE-2018-13382 Fortinet FortiOS and FortiProxy Improper Authorization
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Known to be used
Weakness
CWE-285
Description
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fortinet FortiOS, FortiProxy | Versions not published |
References
- fortiguard.com fortiguard.com
- www.fortiguard.com www.fortiguard.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Fortinet FortiOS, FortiProxy
The 6 CVEs of Fortinet FortiOS, FortiProxy →
CVE-2022-29055
A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0…
7.5
High
CVE-2021-43206
A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through…
4.3
Medium
CVE-2021-26092
Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0…
4.7
Medium
CVE-2021-26110
An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below,…
7.8
High