{"id":"CVE-2018-13382","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-13382","generatedAt":"2026-10-28T20:26:44.858Z","title":"Fortinet FortiOS and FortiProxy Improper Authorization","description":"An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests","published":"2019-06-04T21:29:00.000Z","lastModified":"2026-06-17T01:39:19.000Z","status":"Analyzed","sourceIdentifier":"psirt@fortinet.com","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"cwe":["CWE-863"],"affected":["fortinet/fortiproxy","fortinet/fortios"],"epss":{"score":0.81691,"percentile":0.99641,"date":"2026-10-27","history":[]},"kev":{"listed":true,"dateAdded":"2022-01-10","dueDate":"2022-07-10","knownRansomwareCampaignUse":"Known","notes":"Apply updates per vendor instructions.\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-13382"},"exploits":{"count":1,"verified":false,"firstPublished":"2020-11-19","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":49074,"kind":"exploit","title":"Fortinet FortiOS 6.0.4 - Unauthenticated SSL VPN User Password Modification","url":"https://www.exploit-db.com/exploits/49074","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/hardware/webapps/49074.py","file":"exploits/hardware/webapps/49074.py","published":"2020-11-19","added":"2020-11-19","updated":"2020-11-19","author":"Ricardo Longatto","type":"webapps","platform":"hardware","port":null,"verified":false,"codes":["CVE-2018-13382"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 10 July 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"https://fortiguard.com/advisory/FG-IR-18-389","tags":["Vendor Advisory"],"source":"psirt@fortinet.com"},{"url":"https://www.fortiguard.com/psirt/FG-IR-20-231","tags":["Vendor Advisory"],"source":"psirt@fortinet.com"},{"url":"https://fortiguard.com/advisory/FG-IR-18-389","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.fortiguard.com/psirt/FG-IR-20-231","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-13382","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}