CVE-2018-13382: [FortiProxy] SSL VPN account hijack (unauthorized modification of users passwords)
An improper access control vulnerability in FortiProxy SSL VPN web portal may allow an unauthenticated and remote attacker to change local SSL-VPN users' passwords via specially crafted HTTP requests.
Other sources
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-13382?
The severity of CVE-2018-13382 is critical with a severity value of 9.1.
What is the affected software for CVE-2018-13382?
The affected software for CVE-2018-13382 is Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, and 5.4.1 to 5.4.10, as well as FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, and 1.0.0 to 1.0.7.
How does CVE-2018-13382 affect SSL VPN web portal users?
CVE-2018-13382 allows an unauthenticated attacker to modify the password of an SSL VPN web portal user.
How can I fix CVE-2018-13382?
To fix CVE-2018-13382, it is recommended to apply the necessary security patches provided by Fortinet.
Where can I find more information about CVE-2018-13382?
You can find more information about CVE-2018-13382 on the FortiGuard advisory FG-IR-18-389 and the FortiGuard PSIRT advisory FG-IR-20-231.