CVE-2018-13379

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

Fortiproxy

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.

4. Jun 2019

Ausgewertete Quellen

• Hersteller
  https://fortiguard.com/advisory/FG-IR-18-384
• Hersteller
  https://www.fortiguard.com/psirt/FG-IR-20-233
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13379
• CISA
  Fortinet FortiOS SSL VPN Path Traversal Vulnerability
• NVD
  CVE-2018-13379