CVE-2018-13383

CVE-2018-13383 is a medium-severity (CVSS 4.3) vulnerability in Fortinet FortiOS and FortiProxy. CISA added it to the Known Exploited Vulnerabilities catalog on January 10, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 10, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Fortinet has 32 vulnerabilities in the KEV catalog, 14 of them linked to ransomware.

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

• https://fortiguard.com/advisory/FG-IR-18-388
• https://fortiguard.com/advisory/FG-IR-20-229
• https://fortiguard.com/advisory/FG-IR-18-388
• https://fortiguard.com/advisory/FG-IR-20-229
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13383