{"id":"CVE-2018-13382","kind":"vulnerability","aliases":["CVE-2018-13382"],"related":[],"title":"Fortinet FortiOS and FortiProxy: Fortinet FortiOS and FortiProxy Improper Authorization","description":"An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests","summary":"Fortinet FortiOS and FortiProxy have an improper authorization flaw in the SSL VPN web portal. An unauthenticated attacker can change a user's password, which can lead to VPN account takeover.","severity":"critical","cvss":9.1,"epss":0.81691,"exploited":true,"exploited_at":"2022-01-10T00:00:00+00:00","products":[{"name":"Fortinet FortiOS and FortiProxy","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","fortios","fortiproxy","ransomware","self-hosted","ssl-vpn","vendor"],"not_affected_if":["ssl-vpn-disabled"],"how_to_check":"Check whether the SSL VPN web portal is enabled on FortiOS or FortiProxy devices and confirm the firmware version against the vendor advisory. unknown for exact affected version range from these sources.","fix":"Apply the vendor firmware update per Fortinet's advisory; CISA requires applying updates per vendor instructions. Exact fixed version: unknown.","status":"open","published_at":"2019-06-04T21:29:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:45+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:31:45Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor firmware update per Fortinet's advisory; CISA requires applying updates per vendor instructions. Exact fixed version: unknown.","reach":"internet","impact":"high","summary":"Fortinet FortiOS and FortiProxy have an improper authorization flaw in the SSL VPN web portal. An unauthenticated attacker can change a user's password, which can lead to VPN account takeover.","category":"vendor","who_cares":["fortios","fortiproxy","ssl-vpn","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker changes VPN user passwords and gains network access.","analyst_note":"Find the Fortinet advisory for CVE-2018-13382 to confirm affected and fixed firmware versions and the SSL VPN configuration that is exposed.","how_to_check":"Check whether the SSL VPN web portal is enabled on FortiOS or FortiProxy devices and confirm the firmware version against the vendor advisory. unknown for exact affected version range from these sources.","needs_analyst":true,"not_affected_if":["ssl-vpn-disabled"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000506,"input_tokens":2862,"output_tokens":439,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-13382':13A,16A '-2018':12A,15A '1.0.0':89C '1.0.7':91C '1.1.0':86C '1.1.6':88C '1.2.0':83C '1.2.8':85C '2.0.0':82C '5.4.1':77C '5.4.10':79C '5.6.0':73C '5.6.8':75C '6.0.0':70C '6.0.4':72C 'account':61B 'allow':97C 'and':19A 'attack':49B,100C 'author':10A,39B,65C 'chang':51B 'craft':114C 'cve':11A,14A 'exploit':21B 'flaw':40B 'fortinet':1A,5A,17A,32B,68C 'fortio':2A,6A,22B,33B,69C 'fortios':18A 'fortiproxi':4A,8A,23B,35B,81C 'fortiproxy':20A 'host':27B 'http':115C 'improp':9A,38B,64C 'lead':58B 'modifi':102C 'password':55B,104C 'portal':46B,96C,110C 'ransomwar':24B 'request':116C 'self':26B 'self-host':25B 'special':113C 'ssl':29B,43B,93C,107C 'ssl-vpn':28B 'takeov':62B 'unauthent':48B,99C 'user':53B,111C 'vendor':31B 'via':112C 'vpn':30B,44B,60B,94C,108C 'vulner':66C 'web':45B,95C,109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-06-04T21:29:00+00:00","kev":{"dateAdded":"2022-01-10","dueDate":"2022-07-10","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-13382","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-13382","severity":null,"published_at":"2022-01-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2018-13382","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-13382","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-13382","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-13382","severity":null,"published_at":"2019-06-04T21:29:00+00:00","modified_at":"2026-06-17T01:39:18+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}