CVE-2018-13382

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-13382
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://fortiguard.com/advisory/FG-IR-18-389 Vendor Advisory
https://www.fortiguard.com/psirt/FG-IR-20-231 Vendor Advisory
https://fortiguard.com/advisory/FG-IR-18-389 Vendor Advisory
https://www.fortiguard.com/psirt/FG-IR-20-231 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
History

24 Oct 2025, 12:52

Type Values Removed Values Added
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382 - US Government Resource

22 Oct 2025, 00:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382 -

21 Oct 2025, 20:17

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:17

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382 -

21 Nov 2024, 03:46

Type Values Removed Values Added
CVSS v2 : 5.0
v3 : 7.5 		v2 : 5.0
v3 : 9.1
References () https://fortiguard.com/advisory/FG-IR-18-389 - Vendor Advisory () https://fortiguard.com/advisory/FG-IR-18-389 - Vendor Advisory
References () https://www.fortiguard.com/psirt/FG-IR-20-231 - Vendor Advisory () https://www.fortiguard.com/psirt/FG-IR-20-231 - Vendor Advisory

24 Jul 2024, 17:00

Type Values Removed Values Added
References () https://fortiguard.com/advisory/FG-IR-18-389 - Mitigation, Vendor Advisory () https://fortiguard.com/advisory/FG-IR-18-389 - Vendor Advisory
References () https://www.fortiguard.com/psirt/FG-IR-20-231 - () https://www.fortiguard.com/psirt/FG-IR-20-231 - Vendor Advisory
First Time Fortinet fortiproxy
CVSS v2 : 5.0
v3 : 9.1 		v2 : 5.0
v3 : 7.5
CWE CWE-285 CWE-863
CPE cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*

03 Jun 2021, 11:15

Type Values Removed Values Added
Summary An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests. An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
References
  • {'url': 'http://packetstormsecurity.com/files/160130/Fortinet-FortiOS-6.0.4-Password-Modification.html', 'name': 'http://packetstormsecurity.com/files/160130/Fortinet-FortiOS-6.0.4-Password-Modification.html', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf', 'name': 'https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'http://www.securityfocus.com/bid/108697', 'name': '108697', 'tags': [], 'refsource': 'BID'}
  • {'url': 'https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/', 'name': 'https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/', 'tags': [], 'refsource': 'MISC'}
  • (CONFIRM) https://www.fortiguard.com/psirt/FG-IR-20-231 -
Information

Published : 2019-06-04 21:29

Updated : 2025-10-24 12:52

NVD link : CVE-2018-13382

Mitre link : CVE-2018-13382

CVE.ORG link : CVE-2018-13382

JSON object : View

Products Affected

fortinet

  • fortios
  • fortiproxy
CWE
CWE-863

Incorrect Authorization