CVE-2018-13382

Summary

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests

Affected Software

Weaknesses

• Improper Access Control

ADP Enrichment

CVE Program Container

Additional References

• https://fortiguard.com/advisory/FG-IR-18-389
• https://www.fortiguard.com/psirt/FG-IR-20-231

CISA ADP Vulnrichment

• SSVC:
• Exploitation: active
  • Automatable: yes
  • Technical Impact: total

Additional References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382

References

• https://fortiguard.com/advisory/FG-IR-18-389
• https://www.fortiguard.com/psirt/FG-IR-20-231

• ←Previous
• Next→