Live › vulnerability › CVE-2018-13374
Go to dashboardFortinet FortiOS and FortiADC have an improper access control flaw in the LDAP server connectivity test. An attacker can point that test at a rogue LDAP server and collect the LDAP bind credentials configured on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Fortinet FortiOS and FortiADC | vendor | – | – |
| fortinet fortiadc | vendor | >= 5.4.0, < 5.4.5 | 5.4.5 |
| fortinet fortiadc | vendor | >= 6.0.0, < 6.0.2 | 6.0.2 |
| fortinet fortiadc | vendor | = 6.1.0 | – |
| fortinet fortios | vendor | < 6.0.3 | 6.0.3 |
Unknown from the sources.
Apply the updates from Fortinet's vendor advisory, as CISA requires; the fixed versions are not stated in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
This page as .md · .json · in your agent: get_signal("CVE-2018-13374")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.