VULNERABILITY INTELLIGENCE

CVE-2018-13379

CVSS score9.1 CRITICAL
EPSS probability100.00%
CISA KEVKnown exploited vulnerability
Published2019-06-04
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Known Exploited Vulnerability

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

Vendor / product: Fortinet / FortiOS

Description

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.

Weakness classification

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references