What’s Vulnerable › Vulnerabilities

CVE-2018-13374: Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-09-08
• EPSS: 38.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-01-22 · updated 2026-10-01
• Weakness: CWE-732

Description

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

Affected products

• Fortinet FortiADC: from 5.4.0 before 5.4.5; from 6.0.0 before 6.0.2; 6.1.0 — fixed in 5.4.5, 6.0.2
• Fortinet FortiOS (FortiGate): before 6.0.3 — fixed in 6.0.3

How to fix

Upgrade to a fixed version: Fortinet FortiADC 5.4.5, 6.0.2; Fortinet FortiOS (FortiGate) 6.0.3. Check the vendor advisory for mitigations.

References

• https://fortiguard.com/advisory/FG-IR-18-157
• https://fortiguard.com/advisory/FG-IR-18-157
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13374

Get alerted when CVE-2018-13374 or the next vulnerability affects your stack