# CVE-2018-13382

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests

- Page: https://www.vulneraibility.com/cve/CVE-2018-13382
- CVSS: 9.1
- Known exploited: yes, in CISA KEV since 2022-01-10; CISA due date 2022-07-10; known ransomware use
- EPSS: 81.69% (percentile 99.6)
- Public exploit code: 1 on Exploit-DB · 3 GitHub proofs of concept (first 2019-08-11)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2024-10-23)
- Weakness: CWE-863
- Published: 2019-06-04

## Affected versions

- Fortinet Fortinet FortiOS, FortiProxy: affected FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, 5.4.1 to 5.4.10, FortiProxy 2.0.0, 1.2.0 to 1.2.8,  1.1.0 to 1.1.6, 1.0.0 to 1.0.7

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://fortiguard.com/advisory/FG-IR-18-389
- [other] https://www.fortiguard.com/psirt/FG-IR-20-231
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.