Live › vulnerability › CVE-2018-13382
Go to dashboardFortinet FortiOS and FortiProxy have an improper authorization flaw in the SSL VPN web portal. An unauthenticated attacker can change a user's password, which can lead to VPN account takeover.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Fortinet FortiOS and FortiProxy | vendor | – | – |
Check whether the SSL VPN web portal is enabled on FortiOS or FortiProxy devices and confirm the firmware version against the vendor advisory. unknown for exact affected version range from these sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
This page as .md · .json · in your agent: get_signal("CVE-2018-13382")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.