VULNERABILITY INTELLIGENCE

CVE-2018-13374

CVSS score4.3 MEDIUM

EPSS probability38.09%

CISA KEVKnown exploited vulnerability

Published2019-01-22

Last modified2026-10-01

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Known Exploited Vulnerability

Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

Vendor / product: Fortinet / FortiOS and FortiADC

Description

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

Weakness classification

nvd@nist.gov: CWE-732
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-732

Primary references

psirt@fortinet.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource