CVE-2018-13382

Fortinet FortiOS and FortiProxy Improper Authorization

Fortiproxy

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests

4. Jun 2019

Ausgewertete Quellen

• Hersteller
  https://fortiguard.com/advisory/FG-IR-18-389
• Hersteller
  https://www.fortiguard.com/psirt/FG-IR-20-231
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382
• CISA
  Fortinet FortiOS and FortiProxy Improper Authorization
• NVD
  CVE-2018-13382