{"schemaVersion":3,"id":"CVE-2018-13382","aliases":[],"status":"published","duplicateOf":null,"title":"Fortinet FortiOS and FortiProxy Improper Authorization","description":"An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests","dates":{"published":"2019-06-04T20:33:53.000Z","modified":"2025-10-21T23:45:35.394Z","reserved":null,"kevAdded":["2022-01-10T00:00:00.000Z"],"kevDue":["2022-07-10T00:00:00.000Z"]},"cvss":{"headline":{"score":9.1,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.1,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.81691,"percentile":0.99643,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.81691},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.81691,"percentile":0.99643}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.81691,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.81691,"percentile":0.99643}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-01-10T00:00:00.000Z","dueDate":"2022-07-10T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Fortinet FortiOS and FortiProxy Improper Authorization","description":"An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-13382","label":"nvd.nist.gov/vuln/detail/CVE-2018-13382"}],"vendor":"Fortinet","product":"FortiOS and FortiProxy","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-01-10T00:00:00.000Z","dueDate":"2022-07-10T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Fortinet FortiOS and FortiProxy Improper Authorization","description":"An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-13382","label":"nvd.nist.gov/vuln/detail/CVE-2018-13382"}],"vendor":"Fortinet","product":"FortiOS and FortiProxy","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"49074","name":"Fortinet FortiOS 6.0.4 - Unauthenticated SSL VPN User Password Modification","source":"exploit-database","url":"https://www.exploit-db.com/exploits/49074","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":null,"platforms":["hardware"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"webapps","platform":"hardware","file":"exploits/hardware/webapps/49074.py","codes":["CVE-2018-13382"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-863","name":"Incorrect Authorization","description":"The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/863.html"}],"affected":[{"vendor":"fortinet","product":"fortinet fortios, fortiproxy","name":"Fortinet FortiOS, FortiProxy","label":"fortinet fortios, fortiproxy","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, 5.4.1 to 5.4.10, FortiProxy 2.0.0, 1.2.0 to 1.2.8,  1.1.0 to 1.1.6, 1.0.0 to 1.0.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, 5.4.1 to 5.4.10, FortiProxy 2.0.0, 1.2.0 to 1.2.8,  1.1.0 to 1.1.6, 1.0.0 to 1.0.7","eol":null,"hubHref":"/vendor/fortinet/fortinet_fortios_fortiproxy"},{"vendor":"fortinet","product":"fortios","name":"fortios","label":"fortios","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.4.1, < 5.4.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.6.0, < 5.6.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, < 6.0.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.4.1, < 5.4.11 | ≥ 5.6.0, < 5.6.9 | ≥ 6.0.0, < 6.0.5","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"fortios","label":"FortiOS","category":"os"}},"hubHref":"/vendor/fortinet/fortios"},{"vendor":"fortinet","product":"fortiproxy","name":"fortiproxy","label":"fortiproxy","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.2.9","noFixRecorded":false,"fixedIn":null},{"text":"2.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.9 | 2.0.0","eol":null,"hubHref":"/vendor/fortinet/fortiproxy"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://fortiguard.com/advisory/FG-IR-18-389","label":"fortiguard.com/advisory/FG-IR-18-389","hostname":"fortiguard.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"https://www.fortiguard.com/psirt/FG-IR-20-231","label":"www.fortiguard.com/psirt/FG-IR-20-231","hostname":"www.fortiguard.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2019-06-04T20:33:53.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-01-10T00:00:00.000Z","label":"Added to CISA KEV","detail":"Fortinet FortiOS and FortiProxy Improper Authorization","source":"cisa"},{"kind":"kev-due","date":"2022-07-10T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:45:35.394Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T23:01:20.093Z","stale":false,"partial":false}}