CVE-2018-13383
MediumActively exploited (CISA KEV)Known to be used in ransomware campaigns
Description
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Fortinet FortiOS and FortiProxy
PublishedMay 29, 2019
First seenMay 29, 2019
Added to KEVJan 10, 2022
Weakness typeCWE-787Out-of-bounds write
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Jul 10, 2022Update
- fortinet fortiproxy1.2.9 or later
- fortinet fortios5.2.15, 5.4.13, 5.6.11, 6.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortiproxy | v < 1.2.9, 2.0.0 | 1.2.9 |
| fortinet fortios | 5.2.0 ≤ v < 5.2.15, 5.4.0 ≤ v < 5.4.13, 5.6.0 ≤ v < 5.6.11, 6.0.0 ≤ v < 6.0.5 | 5.2.15, 5.4.13, 5.6.11, 6.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.