CVE-2018-13382: Fortinet FortiOS and FortiProxy Improper Authorization

Vulnerability summary

CVE-2018-13382 is a critical (CVSS 9.1) Incorrect Authorization vulnerability in Fortinet FortiOS and FortiProxy. It is known to be exploited: CISA lists it, first on 10-01-2022. It has been used in ransomware campaigns. EPSS estimates a 81.69% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 04-06-2019
   PublishedVulnerability first disclosed.
2. 10-01-2022
   Added to CISA KEVFortinet FortiOS and FortiProxy Improper Authorization
3. 10-07-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.