{"id":"CVE-2018-13374","kind":"vulnerability","aliases":["CVE-2018-13374"],"related":[],"title":"A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to…","description":"A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.","summary":"Fortinet FortiOS and FortiADC have an improper access control flaw in the LDAP server connectivity test. An attacker can point that test at a rogue LDAP server and collect the LDAP bind credentials configured on the device.","severity":"high","cvss":4.3,"epss":0.38088,"exploited":true,"exploited_at":"2022-09-08T00:00:00+00:00","products":[{"name":"Fortinet FortiOS and FortiADC","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"fortinet fortiadc","fixed":["5.4.5"],"affected":">= 5.4.0, < 5.4.5","ecosystem":"vendor"},{"name":"fortinet fortiadc","fixed":["6.0.2"],"affected":">= 6.0.0, < 6.0.2","ecosystem":"vendor"},{"name":"fortinet fortiadc","fixed":[],"affected":"= 6.1.0","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["6.0.3"],"affected":"< 6.0.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","fortiadc","fortigate","fortios","infrastructure","ransomware","self-hosted"],"not_affected_if":["no-ldap-configured","unpatched-version-not-in-range"],"how_to_check":null,"fix":"Apply the updates from Fortinet's vendor advisory, as CISA requires; the fixed versions are not stated in the sources.","status":"open","published_at":"2019-01-22T14:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:42+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:10:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates from Fortinet's vendor advisory, as CISA requires; the fixed versions are not stated in the sources.\nunknown","reach":"network","impact":"medium","summary":"Fortinet FortiOS and FortiADC have an improper access control flaw in the LDAP server connectivity test. An attacker can point that test at a rogue LDAP server and collect the LDAP bind credentials configured on the device.","category":"infrastructure","who_cares":["fortios","fortiadc","fortigate","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker harvests LDAP service account credentials from the firewall configuration.","analyst_note":"Find the affected and fixed FortiOS/FortiADC versions and the Fortinet advisory for CVE-2018-13374; check the CISA KEV entry for due dates and the ransomware tag source.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ldap-configured","unpatched-version-not-in-range"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000489,"input_tokens":2889,"output_tokens":400,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-13374':20A,23A '-2018':19A,22A '5.4.0':17A,98C '5.4.4':100C '5.6.7':9A,90C '6.0.0':14A,95C '6.0.1':16A,97C '6.0.2':8A,89C '6.1.0':13A,94C 'access':3A,52B,84C 'allow':101C 'and':26A 'attack':62B,102C 'bind':76B 'collect':73B 'configur':78B,110C,129C 'connect':59B,118C 'control':4A,53B,85C 'credenti':77B,109C 'cve':18A,21A 'devic':81B 'exploit':36B 'flaw':54B 'fortiadc':12A,27A,29A,31A,33A,37B,48B,93C 'fortig':38B,112C 'fortinet':6A,24A,28A,30A,32A,34A,45B,87C 'fortio':7A,39B,46B,88C 'fortios':25A,35A 'host':44B 'improp':2A,51B,83C 'infrastructur':40B 'instead':126C 'ldap':57B,70B,75B,106C,116C,124C 'login':108C 'obtain':104C 'one':130C 'point':64B,114C 'ransomwar':41B 'request':120C 'rogu':69B,123C 'self':43B 'self-host':42B 'server':58B,71B,107C,117C,125C 'test':60B,66B,119C 'via':113C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-01-22T14:29:00+00:00","kev":{"dateAdded":"2022-09-08","dueDate":"2022-09-29","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-13374","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-13374","severity":null,"published_at":"2022-09-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2018-13374","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-13374","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-13374","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-13374","severity":null,"published_at":"2019-01-22T14:29:00+00:00","modified_at":"2026-10-01T19:17:13+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}