9.1
Critique
CVE-2018-13382 Fortinet FortiOS and FortiProxy Improper Authorization
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply updates per vendor instructions.
Campagnes de rançongiciel
Utilisation connue
Faiblesse
CWE-285
Description
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Fortinet FortiOS, FortiProxy | Versions non publiées |
Autres CVE de Fortinet FortiOS, FortiProxy
Les 6 CVE de Fortinet FortiOS, FortiProxy →
CVE-2022-29055
A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0…
7.5
Élevée
CVE-2021-43206
A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through…
4.3
Moyenne
CVE-2021-26092
Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0…
4.7
Moyenne
CVE-2021-26110
An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below,…
7.8
Élevée