vulnwire
4.3med

CVE-2018-13383KEV · ransomwarein critical feed

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiPro…

Published 7 y ago · modified 4 mo ago · JSON

CVSS
4.3
v3.1 · CNA
CISA KEV
Yes
added 2022-01-10
EPSS
32.5%
percentile 98%
Public exploits
0
none known

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

Known exploited (CISA KEV)

Added
4 y ago
Due date
2022-07-10 (4 y ago)
Ransomware use
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor / product
Fortinet / FortiOS and FortiProxy
CISA name
Fortinet FortiOS and FortiProxy Out-of-bounds Write

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction (EPSS)

32.47% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.14.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA3.14.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD3.16.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products

  • Fortinet Fortinet FortiOS and FortiProxy

Classification

Weakness
Technology feeds
Fortinet (RSS, critical only)

References

  • fortiguard.com /advisory/FG-IR-18-388 · x_refsource_CONFIRM, x_transferred
  • fortiguard.com /advisory/FG-IR-20-229 · x_refsource_CONFIRM, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13383 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.