# CVE-2018-13383

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

- Page: https://www.vulneraibility.com/cve/CVE-2018-13383
- CVSS: 4.3
- Known exploited: yes, in CISA KEV since 2022-01-10; CISA due date 2022-07-10; known ransomware use
- EPSS: 30.67% (percentile 98.3)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2024-10-23)
- Weakness: CWE-787
- Published: 2019-05-29

## Affected versions

- Fortinet Fortinet FortiOS and FortiProxy: affected FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier, FortiProxy 2.0.0, 1.2.8 and earlier

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://fortiguard.com/advisory/FG-IR-18-388
- [other] https://fortiguard.com/advisory/FG-IR-20-229
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13383

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.