VULNERABILITY INTELLIGENCE

CVE-2018-13382

CVSS score9.1 CRITICAL
EPSS probability81.69%
CISA KEVKnown exploited vulnerability
Published2019-06-04
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Known Exploited Vulnerability

Fortinet FortiOS and FortiProxy Improper Authorization

Vendor / product: Fortinet / FortiOS and FortiProxy

Description

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests

Weakness classification

  • CWE-863: Incorrect Authorization

Primary references