What’s Vulnerable › Vulnerabilities

CVE-2018-13382: Fortinet FortiOS and FortiProxy Improper Authorization

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-01-10
• EPSS: 81.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-06-04 · updated 2026-06-17
• Weakness: CWE-863

Description

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests

Affected products

• Fortinet FortiOS (FortiGate): from 5.4.1 before 5.4.11; from 5.6.0 before 5.6.9; from 6.0.0 before 6.0.5 — fixed in 5.4.11, 5.6.9, 6.0.5
• Fortinet FortiProxy: before 1.2.9; 2.0.0 — fixed in 1.2.9

How to fix

Upgrade to a fixed version: Fortinet FortiOS (FortiGate) 5.4.11, 5.6.9, 6.0.5; Fortinet FortiProxy 1.2.9. Check the vendor advisory for mitigations.

References

• https://fortiguard.com/advisory/FG-IR-18-389
• https://www.fortiguard.com/psirt/FG-IR-20-231
• https://fortiguard.com/advisory/FG-IR-18-389
• https://www.fortiguard.com/psirt/FG-IR-20-231
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382

Get alerted when CVE-2018-13382 or the next vulnerability affects your stack